– Resides on a particular computer or server and monitors activity only on that system
– Benchmark and monitor the status of key system files and detect when intruder creates, modifies, or deletes files
– Most HIDPSs work on the principle of configuration or change management
– Advantage over NIDPS: can usually be installed so that it can access information encrypted when traveling over network