Operating system independence network-based IDS are not dependent on host operating systems as detection sources. By way of comparison, host-based systems require specific operating systems to function properly without having been compromised to generate meaningful results. For example, a host-based IDS can monitor all user logon and logoff activity, as well as what each user does while connected to the network. It is very difficult for a network-based system to provide this level of event detail. Host-based technology can also monitor activities that are normally executed only by an administrator.
Operating systems log any event where user accounts are added, deleted, or modified.
The host-based IDS can detect an improper change as soon as it is executed. Host-based IDS can also audit policy changes that affect what systems track in their logs. Finally, host-based systems can monitor changes to key system files and executables. Attempts to overwrite vital system files, or to install trojan horses or backdoors, can be detected and stopped. Network-based systems sometimes miss this kind of activity.