Describe the features of anomaly based intrusion detection scheme.

Question

Question

Answer 1

Answer #1

Solution:

The features of Anamoly detection system is given below:

Data related to the behavior of legitimate users is collected over a period of time.
Statistical tests are applied to observe the behavior and to determine the behavior is that of a legitimate user or intruder.
This detection technique is more effective to detect masqueraders.
There are two types of approaches to detect changes in the behavior of individual accounts. They are "threshold detection" and "profile based detection".

I hope this helps if you find any problem. Please comment below. Don't forget to give a thumbs up if you liked it. :)

Answer 2

Similar Homework Help Questions

QUESTION 38 A signature-based and anomaly-based system are two different implementations of a __________. A. Intrusion...

QUESTION 38 A signature-based and anomaly-based system are two different implementations of a __________. A. Intrusion Prevention System. B. Intrusion Detection System C. firewall
differentiate between the different types of intrusion detection systems and explain their uses. Describe optimum locations...

differentiate between the different types of intrusion detection systems and explain their uses. Describe optimum locations for IDS on a corporate TCP/IP network and explain how IDSs can be used to complement firewalls.
Network Security The need for intrusion detection systems (IDS) and intrusion prevention systems (IPS) and how...

Network Security The need for intrusion detection systems (IDS) and intrusion prevention systems (IPS) and how they can effectively be used in a network operations setting?

Q1: Discuss the host and network based intrusion detection system Q2: Discuss the different components of...

Q1: Discuss the host and network based intrusion detection system Q2: Discuss the different components of snort with the appropriate diagram Q3:Error Correction (Hamming Code) The following is a corrupted ECC data. 101101101100 Find out the actual data (after removing ECC bits). Q4: Explain Raid0, Raid1, and Raid2
How do intrusion detection systems differ from intrusion prevention systems? Give an example from either a...

How do intrusion detection systems differ from intrusion prevention systems? Give an example from either a network or a host point of view
How does "encryption in-flight" using IPSec, SSL, or TLS impact the visibility of Network Intrusion Detection/Prevention?...

How does "encryption in-flight" using IPSec, SSL, or TLS impact the visibility of Network Intrusion Detection/Prevention? Why don't firewalls have the same visibility issue? Why don't Host based Intrusion Detection/Prevention Systems have the same visibility issue? Why don't Proxy Servers have the same visibility issue?

What is the difference between a network intrusion detection system (NIDS) and a network intrusion prevention...

What is the difference between a network intrusion detection system (NIDS) and a network intrusion prevention system (NIPS)? a. There is no difference; a NIDS and a NIPS are equal. b. A NIPS can take actions more quickly to combat an attack. c. A NIDS provides more valuable information about attacks. d. A NIPS is much slower because it uses protocol analysis.
Intrusion detection systems have fundamental flaws in their designs and functionalities. Intrusion detection does not necessarily...

Intrusion detection systems have fundamental flaws in their designs and functionalities. Intrusion detection does not necessarily prevent intrusions. As more organizations encrypt traffic, it becomes increasingly difficult to track intrusions because IDSs have no capabilities to examine encrypted traffic and are, therefore, unable to recognize problems and create alerts. Engineers rely heavily on IDSs to fight hackers. If configured improperly, the IDS will generate false positive alerts, which can be disastrous to the organization. Too many alerts can cause security...
Why is an intrusion detection system sometimes connected to a network in addition to the one...

Why is an intrusion detection system sometimes connected to a network in addition to the one it is monitoring? (Computer Security II)

Using a statistical intrusion detection system, we want a system with a very high true positive...

Using a statistical intrusion detection system, we want a system with a very high true positive rate and a very low ______ rate. (Fill in the blank) A. false-positive B. rule-based C. true-negative D. base E. false-negative