merkow ppt 12-JRM

Intrusion Detection Systems (IDS)
-Two Classes cont.
� Anomaly intrusions
� Observations of deviations from normal system
usage patterns
� Can be detected by building up a profile of the
system in question and detecting significant
deviations from the profile
� Can use neural networks, machine learning
classification techniques
� Harder to detect
© Pearson Education Information Security:
Principles and Practices 32