A behavior-based IDS instead looks at actions, attempting to identify attacks by monitoring system or network activity and flagging any activity that doesn't seem to fit in. Such activities may trigger an alarm - often a false alarm. Though false positives are common with a behavior-based IDS, so is the ability to detect a previously unreported attack. One manager of a prominent Web site often uses a honeypot to handle all inbound requests. Any attacks against the honeypot are made to seem successful, giving administrators time to mobilize, log and track the attacker without ever exposing production systems.
Intrusion detection requires considerable planning.
As with virus detection, host-based intrusion detection that monitors system and file changes must be installed on pristine systems. It's even more important to have a clear procedure in place for dealing with intrusions. It's not always best to simply pull the plug once you know that an intrusion is under way. Depending on what systems or networks have been compromised and what you want to happen to the attackers, it's often preferable to keep the attackers in the system and contact a law enforcement agency to try to catch them. You want to keep intruders out, but you also want to discover and locate them when they succeed.