A firewall blocks unwanted traffic while an IDS watches for anomalies, so the IDS is a measure that is:

1. A firewall stops traffic before it gets in. 2. An IDS instead notices patterns that look wrong. 3. So the IDS is a detective measure. _Source: OpenStax Foundations of Information Systems, Chapter 5, Information Systems Security Risk Management._