Host-based IDS can also audit policy changes that affect what systems track in their logs. Finally, host-based systems can monitor changes to key system files and executables. Attempts to overwrite vital system files, or to install trojan horses or backdoors, can be detected and stopped. Network-based systems sometimes miss this kind of activity. For example, attacks from the keyboard of a critical server do not cross the network, and so cannot be seen by a network-based intrusion detection system.
Switches allow large networks to be managed as many smaller network segments.
As a result, it can be difficult to identify the best locations for deploying a network-based IDS to achieve sufficient network coverage. Traffic mirroring and administrative ports on switches can help, but these techniques are not always appropriate. Host-based intrusion detection provides greater visibility in a switched environment by residing on as many critical hosts as needed. Certain types of encryption also present challenges to network-based intrusion detection. Depending where the encryption resides within the protocol stack, it may leave a network- based system blind to certain attacks.