A host-based intrusion detection system (hids) is an intrusion detection system that monitors and analyses information from the operating system audit records occurring on the host. These operations are then compared to a predefined security policy norm. This analysis of the audit trail forces significant overhead requirements on the system due to the increased amount of processing power which must be utilized by the intrusion detection system. Depending on the size of the audit trail and the processing ability of the system, the review of audit data could result in the loss of a real-time analysis capability.