Intrusion detection systems feature full time monitoring tools placed at the most vulnerable points or ―hot spots‖ of corporate networks to detect and deter intruder continually. The system generates an alarm if it finds a suspicious or anomalous event. Scanning software looks for patterns indicative of known methods of computer attacks, such as bad password, checks to see if important files have been removed or modified and sends warning of vandalism or system
administration errors. Monitoring software examines events as they are happening to discover security attacks in progress. The intrusion detection tool can also be customized to shut down a particularly sensitive part of a network if it receives unauthorized traffic.