The difference between anomaly detection and behavior detection

Question

There are two methods in an intrusion detection system: Anomaly detection and behavior detection. I implement IDS from scratch and check some signatures, and from some site they were presented as various types of detection methods. What is their main difference? It seems to me that both of them are the same, and therefore the same signatures should be able to detect such attacks.

An example of anomaly detection, as indicated on the site: Detection of a function call that is not part of a regular profile

An example of determining the behavior defined on a site: searching for any remote call to cmd.exe.

Now, it seems to me that both are the same things, that is, a deviation from normal behavior, so why were they characterized as different methods?

Answer 1

There is indeed a difference between abnormal and behavioral detection. Before exploring these two questions, I would like to point out that the intrusion detection community uses two additional styles: use-based (based on signature) and specification -based definition , but they are not related to your question.

Abnormal detection

Definition: A two-step approach that first involves training the data system to establish some concept of normality, and then use the established profile for real data to reject the flag.

Example : Look at some of the features of benign URLs, such as their length, character distribution, etc., to determine what a “regular” URL looks like. Using this concept of normality, you will need to specify URLs that are too far from the normal length of the URL or contain too many abnormal characters.

Pros:

• It can detect a potentially wide range of new attacks.

Minuses:

• May miss known attacks.
• May miss new attacks if they do not stick out along the observed dimension.
• High positive balance rate (see base rate error )
• Purity of training data (i.e. no attacks)

Behavioral Discovery

Definition : Search for evidence of compromise, not the attack itself.

Example : tracking shell history for unset HISTFILE , a command that only attackers usually use after compromising a machine.

Pros:

• It can detect a wide range of new attacks.
• Low false positives
• Can be cheap to deploy and monitor.

Minuses:

• Post facto attack has already taken place
• It's easy to dodge the famous

Answer 2

Indeed, “anomaly-based detection” and “behavior-based detection” are not distinguished. Behavioral detection is usually found in the suppliers' technical descriptions, and they relate to the communication patterns (and their functions) that they observe / support the detection mechanism with.

Answer 3

The two main types of IDS are based on signatures and anomalies. The difference is simple: signature IDSs rely on a database of known attacks, while anomalous observations monitor network behavior, determine normal behavior, and in case of any anomalies, these anomalies cause deviations to which it notifies.