Question

Hello, need this answered. thanks

​In IDS, what is the difference between anomaly based monitoring and signature based monitoring?

Answer 1

The names of both the types of monitoring are pretty good indicators of how they work. The signature based montoring is used for monitoring the types of attacks that are already known. In this system we have a list of known indicators of compromise. It looks at this list and detects the attacks by looking for the specific instructions or behavior that were used for past attacks. However the disadvantage of this type of monitoring is that it cannot detect new types of attacks. Also it requires frequent updations as new types of attacks become known.

The anomaly based monitoring is designed to overcome the limitations of the signature based monitoring of updations and the failure to detect new types of attack. It is trained on what is supposed to be a normal behavior and thus anything unusual in the system will be treated as threat. Though it can provide protection against new attacks, it has the disadvantage that it tends to give too many false positives.