Intrusion detection has been there for many years. It monitors network traffic and/or system events like sys calls or other data and determines whether an event is intrusion or not.

But I am curious what has a next generation IDS in addition to a classic one?


Next generation is just marketing lingo and "IDS" itself too, as do IPS, NGFW, UTM and whatever they come up with next week. The underlying technologies got several enhancements in the past, e.g. they can look deeper, may use anomaly detection etc - but in my opinion they are still dumb enough and can still be circumvented with not too much efforts.

Don't let you blend from all the marketing claims about 100s or 1000s of applications they can detect or how fast they are and how secure they are. They give you some protection, but not the advertised one.

And in case you don't believe me but the marketing guys you can read here:

Not the answer you're looking for? Browse other questions tagged or ask your own question.