An IDS uses detectors to detects abnormally in network traffic pattern, e.g., abruptly increase in the number of a particular type of packets. Detectors generally observe
the network traffic, generally at the router or gateway, to find abnormal network pattern.