Intrusion Detection:Host-based Network Intrusion Detection • At each host, monitor all incoming and outgoing network traffic – for each packet: – Analyze 4-tuple and protocol – Examine contents