Which intrusion detection system audits events on a specific host?

Which intrusion detection system audits events on a specific host?

• A. Network-based intrusion detection
• B. Host-based intrusion detection
• C. Log file monitoring
• D. File integrity checking

Answer: (B)

Auditing events on a specific host is the job of a host-based intrusion detection system. It sits on the machine itself and monitors local activity—security logs, file access, system calls, and process behavior—giving visibility into what happens inside that particular host. In contrast, a network-based intrusion detection system watches network traffic across a segment, not the internal events of one machine, and log file monitoring or file integrity checking are techniques often used within host-based systems rather than a separate category of IDS.

Auditing events on a specific host is the job of a host-based intrusion detection system. It sits on the machine itself and monitors local activity—security logs, file access, system calls, and process behavior—giving visibility into what happens inside that particular host. In contrast, a network-based intrusion detection system watches network traffic across a segment, not the internal events of one machine, and log file monitoring or file integrity checking are techniques often used within host-based systems rather than a separate category of IDS.