You may use one among some host based IDS. Some host as well as network based ids are Snort, Suricata and Bro .... To protect a particular system, you install and configure one of them.

Other options come from commercial antimalware vendors (i.e. Symantec). Without knowing your specific configuration it is hard to give a more detail answer.

Once you have your IDS, you will have to tune it (assuming you will have a central console that collects information from your IDS events). Otherwise, your system will be only as good as the protection you get out of the box.

monitor the ports