Intrusion Detection

Systems that watch network traffic and host activity for signs of attack, so a breach is noticed rather than discovered months later.

Assuming Prevention Will Sometimes Fail

Preventive controls, firewalls and access rules, keep most attackers out, but not all. Intrusion detection systems (IDS) provide the eyes to notice when someone gets through. They monitor traffic and system behavior for indicators of compromise and raise alerts. The value is time: the sooner an intrusion is detected, the less damage an attacker can do before being stopped.

Two Detection Strategies

Kronos motion — traffic controller

Signature-based: matches activity against known attack patterns; precise but blind to novel attacks
Anomaly-based: learns normal behavior and flags deviations; catches new attacks but produces more false positives

Network vs Host

A network IDS (NIDS) inspects traffic flowing across the network, seeing broadly but without insight into what happens inside an endpoint. A host IDS (HIDS) runs on individual systems, watching file changes, process activity, and logs, seeing deeply but only on that host. Mature deployments use both, feeding a central monitoring platform.

Detection vs Prevention

An intrusion prevention system (IPS) goes further, actively blocking detected attacks rather than only alerting. In control environments this must be handled carefully: an IPS that blocks legitimate control traffic on a false positive could itself cause an outage, so placement and tuning matter.

Fusion Context

ICS traffic is highly repetitive and predictable, which makes anomaly detection unusually effective: a controller suddenly talking to an unexpected host, or a command outside its normal pattern, stands out sharply. For the Hyperion breeder and burner control networks, passive monitoring is favored on the most safety-critical segments so detection never risks interfering with control, while alerts feed the plant's security monitoring and incident-response process.