Theoretical Foundation of Detection

摘要: We have seen in previous chapters that both misuse detection and anomaly rely on statistical models of the two classes: normal intrusion. Thus, order to obtain these models, we can apply approaches: manual definition machine learning. Manual is usually used by signature-based detection, which knowledge about characteristics known attacks modeled manually. However, this approach time-consuming only be performed experienced experts, leading high development signature updating costs. Alternatively, learning construct required automatically based some given training data. A motivation for necessary data already available or it at least acquired more easily compared effort define model With growing complexity number different attacks, techniques allow building maintaining system (ADS) with less human intervention seem feasible realizing next generation IDSs.