A Brief Observation-Centric Analysis on Anomaly-Based Intrusion Detection

摘要: This paper is focused on the analysis of anomaly-based intrusion detectors' operational capabilities and drawbacks, from perspective their operating environments, instead schemes per se. Based similarity with induction problem, anomaly detection cast in a statistical framework for describing general anticipated behaviors. Several key problems corresponding potential solutions about normality characterization observable subjects hosts networks are addressed respectively, together case studies several representative models. Anomaly evaluation also discussed briefly based some existing achievements. Careful shows that fundamental understanding environments essential stage process establishing an effective model, which therefore worth insightful exploration, especially when we face dilemma between performance computational cost.