Network intrusion is a common misuse of computer systems. An intrusion detection system would monitor current activity of the system and compare it against the normal activity of the system. The super-user accounts for UNIX and NT can be monitored and the activities taken by users of the accounts can be logged. The activities could be matched against policies for the accounts. Track previously known misuses.
Detection is often a reactive process.
Hackers are continually coming up with new methods for breaking into or attacking computer systems. One thing that can be done is to prohibit all known types of attacks. Detection systems will often use a database of past patterns of misuse to detect intrusions. Monitor network packets for possible misuse. A detection system will replicate all the packets that come across a system.