Which method is the best for IDS : heuristic or signature based? [closed]

Question

In signature based IDS: it maintains a database of the signatures that might signal a particular type of the attack.

Problems:

• New attack that has been specifically constructed in order to not match existing attack signatures.
• The attacker crafting the traffic may have access to the same IDS tools we are using, and may be able to test the attack against them in order to specifically avoid our security measures.

Heuristic detection (Anomaly) based IDS: instead of looking for matches, heuristic intrusion detection looks for behavior that is out of the ordinary. Taking a baseline of the normal traffic and activity taking place on the network.

Problems:

• Seeing larger numbers of false positive comparing signature based IDSes.
• If the traffic on the network changes from what was present when we took our baseline, the IDS may see this as attack for a legitimate activity that causes unusual traffic patterns.

So in overall, which one should I prefer?

Answer 1

So in overall,which one should I prefer ?

You should prefer the one where you are able to deal with the logs and how much security you need and how much time you can invest to deal with false positives.

Static signatures will fail to catch new attacks but have usually less false positives. Heuristics might catch more new malware but this usually comes with higher false positive rate. You need to look through the logs and decide yourself if this a true positive (i.e. attack) or not. If you are not able to do this then the heuristics will probably be only in the way when accessing harmless sites.

Apart from that heuristics are usually not used alone because they might be able to detect an attack which has no signature but fails to detect attacks which have a signature. Thus they are usually used together with the static signatures.