In signature based IDS: it maintains a database of the signatures that might signal a particular type of the attack.
- New attack that has been specifically constructed in order to not match existing attack signatures.
- The attacker crafting the traffic may have access to the same IDS tools we are using, and may be able to test the attack against them in order to specifically avoid our security measures.
Heuristic detection (Anomaly) based IDS: instead of looking for matches, heuristic intrusion detection looks for behavior that is out of the ordinary. Taking a baseline of the normal traffic and activity taking place on the network.
- Seeing larger numbers of false positive comparing signature based IDSes.
- If the traffic on the network changes from what was present when we took our baseline, the IDS may see this as attack for a legitimate activity that causes unusual traffic patterns.
So in overall, which one should I prefer?