The anomaly-based intrusion detection system
The anomaly-based intrusion detection system is a system whereby their infrastructure will be trained with data that establishes how the system would look like when normal so that if intrusion does happen, then the system automatically detect the attack as abnormal. This method depends on some form of Artificial Intelligence to flag intrusions. The main strength of the anomaly-based intrusion detection system is that after being trained, the system is capable of flagging a variety of attacks new or old. Other strengths that this system offers to the user is that it can look at the features of numerous features, including the information of user’s agents and hosts. The system is also useful in a company setting because it will be able to flag intrusions from rogue users that are employees who have acquired system privileges that they should not have. The system identifies such used by comparing it to the normal behaviours that are pre-set. However, despite the strengths that the system has, there are also weaknesses associated with the system. The system may fail to recognize known attacks because the attacks mimic the pre-set normal. Another disadvantage is that the system may be trained in the absence of attacks, so when attacks do come, the system has no history of training to recognize the attacks.
On the other hand, the signature-based IDS functions on the principle of detecting attacks that are already known. The system has several strengths that include that the system has a high speed of known processing attacks. The system also has a low rate of false positives because the system works on looking for shreds of evidence of compromise rather than the compromise itself. However, the system cannot detect zero-day exploits. Zero-day exploits are the type of attacks that the developer and the public are unaware of. To select which IDS system to use, I would advise the company to consider the strengths and weaknesses of both, and the extent to which an attacker can compromise the company’s data. Also, the company should consider the resources it will require to run each system and the amount of work it will take to ensure it runs efficiently.