A survey of anomaly intrusion detection techniques

Abstract

Intrusion detection systems are based on two fundamental approaches: the detection of anomalous behavior as it deviates from normal behavior, and misuse detection by monitoring those signatures of those known malicious attacks and system vulnerabilities. Anomaly (behavior-based) IDSs assume the deviation of normal activities under attacks and perform abnormal detection compared with predefined system or user behavior reference model. This paper is to provide a survey of anomaly intrusion detection techniques. It presents a review about the evolution of intrusion detection systems over the past two decades. It focuses on recent research advances and trends in anomaly IDSs, including the application of statistics, machine learning, neural network, computer immunology, and data mining techniques.