Editing Intrusion detection system (section)

== Comparison with firewalls ==
Although they both relate to [[network security]], an IDS differs from a [[Firewall (computing)|firewall]] in that a conventional network firewall (distinct from a [[next-generation firewall]]) uses a static set of rules to permit or deny network connections. It implicitly prevents intrusions, assuming an appropriate set of rules have been defined. Essentially, firewalls limit access between networks to prevent intrusion and do not signal an attack from inside the network. An IDS describes a suspected intrusion once it has taken place and signals an alarm. An IDS also watches for attacks that originate from within a system. This is traditionally achieved by examining network communications, identifying [[Heuristic (computer science)|heuristics]] and patterns (often known as signatures) of common computer attacks, and taking action to alert operators.  A system that terminates connections is called an intrusion prevention system, and performs access control like an [[application layer firewall]].<ref>{{Cite book|url=https://books.google.com/books?id=ebbwmOFWvR8C&q=%22intrusion+prevention+system%22+AND+%22application+layer+firewall%22&pg=PA46|title=Network and System Security|last=Vacca|first=John R.|date=2013-08-26|publisher=Elsevier|isbn=9780124166950|language=en}}</ref>