IDES: a progress report (Intrusion-Detection Expert System)
Teresa F. Lunt, Asuka Tamaru, Fred Gilham, Raj Jagannathan, Peter G. Neumann, Caveh Jalali · 2002
Describes a real-time intrusion-detection expert system (IDES), that observes user behavior on a monitored computer system and adaptively learns what is normal for individual users, groups, remote hosts, and the overall system behavior. Observed behavior is flagged as a potential intrusion if it deviates significantly from the expected behavior or if it triggers a rule in the expert-system rule base.>