This is a great document that answers such questions as What is intrusion detection? and How do I know if I've been attacked?