Implications of IDS Classification on Attack Detection

摘要: Accurate taxonomies are critical for the advancement of research fields. Taxonomies intrusion detection systems (IDSs) not fully agreed upon, and further lack convincing motivation their categories. We survey summarize previously made detection. Focusing on categories relevant methods, we extract commonly used concepts define three new attributes: reference model type, generation process, updating strategy. Using our framework, range terms can easily be explained. study usefulness these attributes with two empirical evaluations. Firstly, use taxonomy to create a existing IDSs, successful result, i.e. IDSs well scattered in defined space. Secondly, investigate whether reason about capability based method classes, as by framework. establish that different methods vary detect specific attack types. The type seems better suited than process such reasoning. However, results tentative relatively small number attacks.