4

I'm having trouble understanding the difference between NIDS (Network-based Intrusion Detection System) and NBA (Network Behavior Analysis)

It is to my understanding that

NIDS use two detection methods :

  • Signature-based detection
  • Anomaly-based detection

and NBA use one detection method :

  • Anomaly-based detection

Both use network "Anomaly-based" detection and both analyse the same kind of sample (packets). Note that NIDS also has a Signature-based detection. Is NBA just a lighter version of NIDS or is there a difference in the way it does Anomalyse-based detection ?

Improve this question
1

1 Answer 1

Reset to default
3

NIDS are designed to inspect the network at certain points, like at ingress/egress points in the network. Its focus is intrusion. Yes, there are signature rules and there are anomaly rule sets, but they focus on the point where traffic passes the NIDS inspection point.

NBA looks at the network. It's looking at bandwidth and protocol use and other factors across the network. It can gather data from across all network devices and work out what is weird/unusual.

And, as per usual in this field, definitions will mutate and change over time as both technologies start to "meet in the middle" and do each other's jobs.

Improve this answer
4
  • Can we consider that NIDS is more stateless that NBA because NIDS is more about performing a packet inspection at instant t while NBA is more statefull and try to correlate packets together ?
    – Xavier59
    Commented Oct 28, 2019 at 15:34
  • No, you can't go that far
    – schroeder ♦
    Commented Oct 28, 2019 at 16:02
  • I'm still not sure I get the difference then. Especially, I do not get this sentence : Yes, there are signature rules and there are anomaly rule sets, but they focus on the point where traffic passes the NIDS inspection point. Could you rephrase it ?
    – Xavier59
    Commented Oct 28, 2019 at 16:07
  • 1
    It's the difference between a microscope and a scanner. One inspects the details and makes conclusions. The other takes in a broad understanding and makes conclusions.
    – schroeder ♦
    Commented Oct 28, 2019 at 16:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .