Anomaly

When an event with a known attack of the match signal, the majority of IDS will alarm. Based on an anomaly (anomaly) of the IDS will then construct a network activities of the host or the general outline, when there is a profile in this other than the time of the incident, IDS will alarm, for example, it was done before he has not done the things When, for example, a user access to a sudden administrator or root privileges. Some manufacturers IDS seen as heuristic function this way, but the IDS a heuristic reasoning in its judgement should have a more intelligent.

Bookmark:Digg Del.icio.us Reddit