Tremp is an IT Security Manager, and he is planning to deploy an IDS in his small company. He is looking for an IDS with the following characteristics: -Verifies success or failure of an attack - Moni

Network-based IDS requires dedicated sensors or tap hardware on network segments, increases cost, and cannot verify attack success or failure on the endpoint because it only inspects packet traffic.

Open source-based IDS describes a licensing model, not a deployment architecture, so it does not define how the system monitors activity or where it is placed.

A host-based IDS installs on the monitored system itself, eliminating the need for dedicated hardware and reducing entry cost. It inspects OS logs, file system changes, and process activity, allowing it to verify whether an attack succeeded or failed and detect local threats such as privilege escalation that a network-based IDS never sees. Near real-time alerts are generated from system-level event monitoring without relying on network traffic capture.

Gateway-based IDS sits at the network perimeter and inspects traffic entering or leaving the network; it cannot monitor internal system activities or detect host-level attacks that do not traverse the gateway.