Anomaly-Based IDS
Definition
An intrusion detection system that models normal traffic behaviour and alerts when observed traffic deviates significantly from that baseline. Detects novel attacks but generates more false positives than signature engines on the same traffic.
- Detection basis
- Deviation from a modelled normal-traffic baseline
- Strength
- Can flag novel, previously unseen attacks
- Weakness
- Higher false-positive rate than signature IDS
- Contrast
- Signature-based IDS matches known attack patterns
Common questions
Why do investigators still value anomaly-based IDS logs despite the false positives?+
A signature engine only fires on attacks it already knows, so anomaly alerts are often the only log trail available for a zero-day intrusion or an insider using otherwise legitimate credentials in an unusual pattern.
How is the baseline for an anomaly-based IDS usually built?+
The system observes network or host activity over a training period to learn normal volume, timing and protocol mix, then flags later traffic that departs from that learned profile by a set statistical margin.
Related terms
- Five-Tuple
- The five fields that uniquely identify a network flow: source IP address, source port, destination IP address, destination port, and transport protocol...
- Lateral Movement
- Attacker activity after initial compromise in which the threat actor traverses from one internal system to another, typically to escalate privileges, access...
- Proxy Log
- A record generated by a forward proxy server for each HTTP or HTTPS request made by an internal client. Contains the URL,...
- Signature-Based IDS
- An intrusion detection system that compares network traffic against a database of known attack patterns (signatures). Snort and Suricata are the dominant...
- True Positive / False Positive
- A true positive is an alert that correctly identifies malicious activity. A false positive is an alert that fires on legitimate traffic....