Home/ Questions/Q 7770289
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-01T16:22:25+00:00

In an Intrusion Detection System, There are two techniques called Anomaly Detection and Behaviour

  • 0

In an Intrusion Detection System, There are two techniques called Anomaly Detection and Behaviour Detection. I am implementing an IDS from scratch and was checking for some signatures and from some site they were given as different types of methods for detection. What is the basic difference in them? As it seems to me that both are same and therefore same signatures should be able to detect these kind of attacks.

Example for Anomaly detection as given on the site: Detecting a function call that is not part of the normal profile

Example for Behaviour detection as given on the site: Searching for any remote invocation of cmd.exe.

Now as it seems to me that both are kind of same things i.e. deviation from normal behaviour so why they were characterised as different methods??

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    There is indeed a difference between anomaly-based and behavioral detection. Before exploring the two, I would like to point out that the
    intrusion detection community uses two additional styles: misused-based (aka. signature-based) and specification-based detection, yet these are unrelated to your question.

    Anomaly-based detection

    Definition: A two-step approach that involves first training a system with data to establish some notion of normality and then use the established profile on real data to flag deviations.

    Example: look at some features of benign URLs, e.g., their length, character distribution, etc., to find define what a “normal” URL looks like. With this notion of normality, you would then flag URLs that are too far off the normal URL length or have too many abnormal characters in them.

    Pros:

    • Can detect potentially a wide range of novel attacks

    Cons:

    • May miss known attacks
    • May miss novel attacks if they don’t stick out along the observed dimension
    • High fals positive rate (see the base rate fallacy)
    • Purity of training data (i.e., absence of attacks)

    Behavior-based detection

    Definition: Looking for evidence of compromise rather than the attack itself.

    Example: monitor the shell history for unset HISTFILE, a command that typically only attackers enter after compromising a machine.

    Pros:

    • May detect a wide range of novel attacks
    • Low false positives
    • Can be cheap to deploy and monitor

    Cons:

    • Post-facto, attack already occurred
    • Easy to evade once known
    • 0