The more corporations try to secure internal networks, the less valuable the networks become. Eventually, the cost of attempting total security outweighs potential loss. Intrusion detection is a cheap way to provide extra security and make up for the lack of static defenses. ID is the continuous monitoring of network and system events in order to detect misuse and anomalous behaviors. Misuse detection is the easiest technique as it consists primarily of pattern matching between actual traffic and known signatures.
Anomaly detection is much more theoretical, and relies upon deviation from known baseline behavior.
Network ICE Corporation.