Intrusion Detection Techniques
Peng Ning, Sushil Jajodia · The Internet Encyclopedia · 2004
Abstract In an information system,intrusionsare the activities that violate the security policy of the system, andintrusion detectionis the process used to identify intrusions. Intrusion detection techniques have been traditionally classified into one of two methodologies:anomaly detectionormisuse detection. This chapter gives an overview of the existing intrusion detection techniques, including anomaly detection and misuse detection models, and identifies techniques related to intrusion detection in distributed systems. Topics covered include statistical models, machine learning and data mining approaches, computer immunological approach, specification‐based approach, information theoretic measures for anomaly detection, rule‐based languages, state transition analysis toolkit, colored Petri automata (CPA), abstraction‐based approach, distributed intrusion detection systems, network‐based intrusion detection systems, and information sharing among intrusion detection systems.