Modeling an Intrusion Detection System Based on Adaptive Immunology

2. Intrusion Detection Systems

Intrusion Detection systems are classified into two types based on their detection methodology (Butun, Morgera & Sankar, 2013). Anomaly based Intrusion detection systems are generally based on the prior knowledge of the system patterns. The normal behavior of the system is noted and they are compared at continuous time intervals. A deviation is noted as an anomaly and an intrusion response is initiated. Signature based or misuse based intrusion detection systems are based on the prior knowledge of the attacks as opposed to the knowledge of the system. Although, Anomaly based IDS create more overhead, they can be able to trace new attacks, unlike misuse based IDS which can be able to identify only the attacks with known profiles. Anomaly based methods can be further classified by their profile creation methods. These profiles could be statistical based, machine learning based or knowledge based. A hybrid model could prove very advantageous, however owing to the energy, memory and size constraints it is generally not preferred to build a hybrid system. See Figure 1 below.