Would Tripwire's use on a system would be detected by malware?
While a properly secured system would make it difficult to detect system security measure like Tripwire, I believe a sophisticated piece of malware could detect the presence of Tripwire or another HIDS. A program like Tripwire is no necessarily hidden, but it is protected by OS access controls. For example removing other read permission to the directory /usr/local/tripwire is not so much hiding as protecting.
Do HIDS [they] take steps to hide and obscure themselves?
Tripwire itself, excluding how an administrator sets it up on a system, does not attempt to hide itself from detection by malware. Tripwire does encrypt and authenticate its configuration and database files. Again I would describe this as protection instead of hiding.
What steps could an attacker take to detect them?
It depends on the system and what vulnerabilities it has. Attacks can be very inventive, and do anything from exploiting specific library functions, to using unintended signaling channels. For example, an attacker developed a method of determining characters in a password by monitoring page-faults.
"Let's say an attacker manages to end the HIDS process...will they report this?"
Depending on how the process was ended a HIDS may or may not explicitly log the unexpected termination. However, a properly configured system should explicitly log the unexpected termination of a security program. Even if the system did not explicitly log the unexpected termination the fact would be easily discoverable by evidence like a missing or incomplete audit report.
"Can an attacker just end and then restart the process without this being reflected in the logs?"
If the system is properly configured, usually no. If the system kept all its audit and logging data locally, the attacker was sophisticated, and the attacker effected a full access compromise, then yes the attacker could modify the HIDS logs to show normal operation.
"What about notifications....can they be prevented from sending out notifications?"
Again it depends on the system, how its security is constructed, and the sophistication of the attacker. A HIDS can be configured to send e-mail or other types of notifications, and the system may be configured to protect those notifications.