I have been researching intrusion detection for a class I am taking and I have come to a certain point where after reading so many articles the difference between the two seems blurry.

Anomaly detection on a network uses statistically analysis to compare new information against regular network traffic.

And misuse detection has a set of predefined patterns that are accepted on the network, i.e a whitelist database of network behaviours.

What i am struggling to understand is at the data level what is the difference? Anomaly detection datasets from my research are usually data packets like this :

0,tcp,http,SF,181,5450,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,8,8,0.00,0.00,0.00,0.00,1.00,0.00,0.00,9,9,1.00,0.00,0.11,0.00,0.00,0.00,0.00,0.00,normal. (KDD99)

Where the information is obtained via monitoring network traffic, so where exactly does misuse detection data come from? If it is a list of valid behaviors how is this list curated? What is its general format?

After using scholar etc some articles pointed to the data set being the same but analysed differently, i.e both use information from network packets but Im unsure if this is correct.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.