I'm currently reading about Intrusion Detection Systems (IDS) and noticed a huge variety of definitions for the term of Deep Packet Inspection. Especially the NIST shows three different techniques in their paper "Guide to Intrusion Detection and Prevention Systems" which are:
- Signature-Based Detection
- Anomaly-Based Detection
- Stateful Protocol Analysis
In a footnote they state that Stateful Protocol Analysis is basically just another term for DPI, which seems fine for me. However Signature-Based Detection is supposed to detect malicious behaviour by comparing signatures of e.g. packets with a given Dataset of known attacks.
This requires in my understanding unpacking data in case of network IDS up to the application layer and actually analyse the packet's data, which sounds like a definition of DPI to me.
On the other hand DPI is defined in various sources as the sum of IDS/IPS and a stateful firewall. Each definition of the term is somehow depending on the other term. Can someone give me a clear and correct definition of IDS in respect to DPI and vice versa?