What is the difference between misuse and anomaly detection methods?
Misuse detection-based IDS analyze packets off the network and compares them to a database of known attack signatures or patterns. Essentially, the IDS looks for specific attacks that it already knows about in every packet it looks at. Synonymous to anti-virus software, these types of IDS are only as good as the database of attacks they knows about. With anomaly detection, the system administrator defines the baseline, or normal, state of the networks traffic load, breakdown, protocol, and typical packet size. The anomaly detector monitors network segments to compare their state to the normal baseline to identify anomalies.
