Intrusion Models There are two intrusion models that most intrusion detection systems look for, anomaly and misuse. The anomaly model looks for behavior that is inconsistent with a user or system's normal behavior. Anomalies might include a user running processes at odd times or a process that is consuming far more resources than usual. The misuse model is designed to find activity corresponding to known system vulnerabilities. Checking your system manually is just one aspect of intrusion detection.
Many tools can help monitor system activity and system health.
You may want to deploy one or more of these tools to help prevent and detect attacks on your system. The Security Administrator's Tool for Analyzing Networks allows systems administrators to find common network-related security flaws. LIDS is a kernel patch and admin tool. Features include a port scanner in the kernel, protection of files and processes, intrusion response, and email alerts. The Abacus Project is an intrusion protection suite of tools including the LogCheck program, PortSentry, and HostSentry.