Service specific anomaly detection for network intrusion detection

摘要: The constant increase of attacks against networks and their resources (as recently shown by the CodeRed worm) causes a necessity to protect these valuable assets. Firewalls are now common installation repel intrusion attempts in first place. Intrusion detection systems (IDS), which try detect malicious activities instead preventing them, offer additional protection when defense perimeter has been penetrated. ID attempt pin down comparing collected data predefined signatures known be (signature based) or model legal behavior (anomaly based).Anomaly based have advantage being able previously unknown but they suffer from difficulty build solid acceptable high number alarms caused unusual authorized activities. We present an approach that utilizes application specific knowledge network services should protected. This information helps extend current, simple traffic models form allows content hidden single packets. describe features our proposed experimental underlines efficiency systems.