Threat Detection

A threat detection system (TDS) is a tool or software program that detects malicious behavior or policy violations of a network or system. Any intrusion behavior or violation is usually reported either to an administrator or collected centrally using a program called security information events management (SIEM). A SIEM framework integrates outputs from multiple sources and uses alarm filtering techniques to differentiate between malicious and false alarm behavior.

TDS types range in scope from single computers to large networks. Network intrusion detection systems (NIDS) and Host-based intrusion detection systems (HIDS) are the most common classifications. An example of a HIDS is a system that tracks critical operating system data, while an instance of a NIDS is a system that analyzes incoming network traffic.