You should then run AIDE as a cron job to periodically verify that nothing has changed. You should also run it manually once in a while. Running AIDE quickly alerts you to unexplained changes in your system files, which could indicate an intrusion. If Microsoft had been running the equivalent of AIDE , they would have detected the break-in within minutes or hours. Snort Snort bills itself as 'a lightweight network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks'.
Snort is a network sniffer which detects and logs suspicious network traffic.
Thus, it is useful to detect intrusion attempts on any machine in a network. Snort works by listening to all the network traffic and comparing what it sees to various rules. These rules specify data patterns used by common Trojans, suspicious port numbers, and so on. This lets you detect intrusion as it is happening and quickly react to it. Again, if Microsoft had used the equivalent of Snort , they would have been alerted to the Trojan's presence within seconds or minutes.