as the topic says I am interested in learning more about anomaly detection in particular I am asking for good starting points and references both from a theoretical point of view and applied one. For the second one (applied) I am interested in tools to use and good "traffic packets sets" which I can use to start digging this area of information security. You can assume I really don't know much about IDS and ML but I do have a good enough background in statistics and math.
Thanks in advance.
This Wikipedia article is a bit of a stub, but has a couple of references to start with.
Theoretical issues with ML based IDSs are that they can be fooled in a number of ways, for example by forcing them to mis-train as in this article. Think of this attack as what spammers do to confuse Bayesian filters.
A huge practical issue is that this approach is extremely slow for modern network speeds. The amount of processing that has to happen for every packet is probably going to grind such an IDS to a halt on a few Mbps.
Traffic packet sets are hard to find. There is this very old one http://nsl.cs.unb.ca/NSL-KDD/ that used to be popular. There is also http://www.netresec.com/?page=PcapFiles.
