Network- and device-level behavioral anomaly detection is an important means of detecting potential security incidents, including DoS or DDoS, or any general intrusions. Anomaly detection mechanisms can be divided into many subclasses:
- Statistical methods: These methods use past behaviors to approximate a model of the correct behavior of a sensor or thing. If the things or networks observe a new behavior, it is compared to the model and, if statistically incompatible, is marked as an anomaly.
- Probabilistic methods: These methods center around the definition of a probabilistic model (parametric or nonparametric). If any the probability of an incident within a device or network falls below a predefined threshold, ...