Debian includes a number of intrusion detection applications. There are three basic classes: Network Intrusion Detection Systems (NIDS), File Monitors, and System Scanners. The former works by scanning network traffic to detect attempts to discover and exploit allowed network connections. The latter works by scanning a known clean system, then monitoring it for new, deleted, and modified files.
