Program or device used to detect that an attacker is or has attempted unauthorised access to computer resources.