Anomaly-Based IDS

Anomaly-Based IDS

Anomaly-based IDS do not use static signatures to detect potential security events. Rather, these IDS use network traffic baselines to determine a "normal" state for the network and compare current traffic to that baseline. If network anomalies occur, the IDS alerts security administrators.

Two types of anomaly-based systems exist, behavior anomaly and protocol anomaly IDS. Both use the same type of statistical calculations to determine whether current traffic deviates from "normal" traffic, yet they specifically track different attributes. Behavior anomaly systems tend to monitor network resources using timing, volume, and similar resource characteristics while protocol anomaly IDS typically monitor application-level traits such as RFC compliancy and other operational protocol content attributes.

As compared to a signature-based IDS, an anomaly-based IDS has the potential to detect new attack vectors as they occur. Anomaly IDS, however, can suffer from numerous false positives as security administrators attempt to determine the dynamic definition of "normal" network operations.