IDS

What is an IDS?

An IDS (Intrusion Detection System) is a security system that continuously analyses network traffic or host activity to detect and report unauthorised, suspicious or malicious activity, without intervening itself. Where a Firewall stops traffic and an IPS (Intrusion Prevention System) actively blocks attacks, an IDS watches and raises alerts. That passive role is exactly what makes an IDS suitable for industrial networks, where interfering with live traffic can disrupt a production process.

🧠 How does an IDS work?

An IDS collects events, such as network packets, log entries or system calls, and compares them with what is known or normal. The idea goes back to the model Dorothy Denning published in 1987: security violations can be recognised by abnormal patterns in the way a system is used. NIST SP 800-94 distinguishes three detection methods, which modern systems usually combine:

• Signature-based detection - compares traffic with patterns of known attacks, exploits or malware. Few false positives, but blind to new attacks and zero-days.
• Anomaly-based detection - first learns a baseline of normal behaviour and reports deviations. It also finds unknown attacks, but produces more false positives. See Anomaly Detection.
• Stateful protocol analysis - understands a protocol and flags commands or sequences that do not fit, for example a Modbus write command where only read traffic belongs.

An IDS can alert in real time or analyse stored traffic afterwards (offline) for investigation.

📦 What types of IDS are there?

In OT a HIDS is often difficult: many PLCs, HMIs and older Windows systems do not support an agent, or the vendor does not allow one. Industrial environments therefore focus on the NIDS.

🔄 What is the difference between an IDS and an IPS?

A so-called active IDS that terminates connections or changes firewall rules on its own is in effect an IPS. In OT this is rarely applied to process networks: a false positive must never stop a pump or a controller. A next-gen firewall often contains both functions, set per rule to detect or block.

🏭 Why is an IDS in OT different from one in IT?

Industrial networks are particularly well suited to detection: a SCADA server polls the same PLCs for the same values every second, and new connections are rare. Any deviation therefore stands out quickly. An OT IDS, also called OT NDR (Network Detection and Response), differs in three ways:

• Passive monitoring - the sensor receives a copy of the traffic via a SPAN port or hardware TAP and transmits nothing itself. See Passive Monitoring.
• Protocol awareness - the sensor decodes industrial protocols such as Modbus TCP, ProfiNET, S7 Comm, DNP3, IEC 60870-5-104 and OPC UA down to function-code level, revealing which station writes to which register.
• Asset discovery - from the traffic the sensor builds an inventory of devices, firmware versions and communication relationships, the basis for asset discovery and vulnerability management.

Typical OT detections include:

• Unexpected communication between PLCs, SCADA systems or an engineering workstation
• Changes to setpoints or PLC logic downloads outside scheduled maintenance windows
• Access to a Historian or MES from unusual IP addresses
• Scans, new devices and behaviour matching known ICS malware such as Stuxnet, Industroyer or TRITON

A network IDS only sees traffic over Ethernet and IP. Classic serial fieldbuses such as Modbus RTU or Profibus stay out of sight, unless a gateway translates that traffic onto the network.

🧰 Which IDS solutions are used?

Commercial OT platforms offer ready-made protocol support and dashboards. Open-source tools cost less, but require more in-house expertise and maintenance.

🔧 How do you deploy an IDS in an OT environment?

A successful rollout is mostly a matter of placement and tuning:

1. Choose the monitoring points - place sensors at the zone boundaries of your network segmentation and on the core switches of levels 1–2, not only at the IT boundary.
2. Choose SPAN or TAP - a SPAN port is cheap, but can drop packets when the switch is busy. A TAP copies all traffic and is passive, which is preferred on critical links.
3. Learn the baseline - run the sensor in learning mode for several weeks, ideally including a maintenance shutdown or batch changeover, so that periodic legitimate traffic is known too.
4. Tune the alerts - classify the first alerts together with process engineers. Known maintenance windows and engineering workstations get exceptions, so analysts do not drown in false positives (alert fatigue).
5. Connect to SIEM and SOC - forward alerts via Syslog or an API to a SIEM and have them handled by an (OT) SOC with agreed incident response procedures.
6. Maintain the sensor - keep signatures and threat intelligence up to date and check after network changes whether the monitoring points still see the right traffic.

🔐 Which standards call for an IDS?

• IEC 62443-3-3 - system requirement SR 6.2 Continuous monitoring (under FR 6, timely response to events) requires ongoing monitoring for security events from Security Level 2 upwards. SR 6.1 covers audit log accessibility.
• NIS2 and the Dutch Cybersecurity Act (Cyberbeveiligingswet), in force since 15 August 2026 - require essential and important entities to take appropriate measures, including detecting and handling incidents.
• NIST SP 800-82 - NIST’s OT security guide recommends passive network monitoring; NIST SP 800-94 describes IDS technology itself.
• MITRE ATT&CK for ICS - helps map detection rules to concrete attack techniques.

An IDS is therefore a standard layer in a Defense in Depth architecture, alongside firewalls, VPN access, EDR and segmentation with a DMZ and VLANs. It contributes to overall security by making attacks visible.

❓ Frequently asked questions

Can an IDS stop an attack?

No, an IDS only detects and reports; it does not block any traffic itself. Stopping attacks is the job of a firewall or IPS. The value of an IDS lies in early visibility, so that a SOC or administrator can act before an attack affects the process.

What is the difference between a NIDS and a HIDS?

A NIDS analyses network traffic from many systems at once via a SPAN port or TAP. A HIDS runs as an agent on a single server or workstation and monitors log files, processes and file integrity. In OT the NIDS is used most, because many industrial devices cannot run an agent.

Does an IDS disrupt the production process?

A passively deployed IDS does not disrupt the production process, because it only receives a copy of the traffic and transmits nothing on the network. Risks only arise with active functions, such as active asset discovery that queries devices. In OT you therefore enable those functions deliberately and sparingly.

How many false positives does an IDS produce?

The number of false positives from an IDS depends mainly on tuning. Signature-based detection produces few false positives, while anomaly-based detection produces many in the first weeks. After a learning period and alignment with process engineers, the number of alerts in a stable OT network drops sharply.

What is the difference between an IDS and NDR?

NDR (Network Detection and Response) is the more recent term for a network IDS that, besides detection, also provides an asset inventory, behavioural analysis and support for investigation and response. OT platforms such as Nozomi, Claroty, Dragos and Tenable OT are usually positioned as NDR. At their core they remain a passive IDS.

Is an IDS mandatory under NIS2?

NIS2 does not name a specific product, but it obliges organisations to take appropriate measures to detect and handle incidents. An IDS or NDR is the usual way to meet that detection obligation in OT. IEC 62443-3-3 explicitly requires continuous monitoring from Security Level 2 upwards.

📌 In summary

An IDS detects attacks, unauthorised access and anomalous behaviour by continuously analysing network traffic or hosts, without intervening itself. In industrial environments a passive OT IDS monitors process communication with knowledge of industrial protocols and, together with a SIEM and SOC, forms the detection layer of a Defense in Depth strategy in line with IEC 62443.