A host-based intrusion detection system (HIDS) is best suited for passively monitoring network traffic as it watches the audit trails and log files of a host system. It is reliable for detecting attacks directed against a host, whether they originate from an external source or are being perpetrated by a user locally logged in to the host. Unlike a NIPS, which actively monitors and can prevent intrusions, HIDS passively analyzes data after it has been collected.