Hands-On Artificial Intelligence for Cybersecurity

Anomaly detection rationales

In the area of ​​network intrusion detection in particular, the following two different approaches have been followed over time:

• Signature-based detection
• Anomaly detection

In the first case, we start from the analysis of attacks that are already known, building a knowledge base of signatures of attacks that were previously detected. This gets combined with an alert system to be launched whenever a correspondence with archived signatures is detected in the network traffic. The analogies of signature-based detection systems with various antivirus software are obvious, and the disadvantages are equally evident, hence the knowledge base of the signatures must be constantly updated to detect new types of attacks. ...