I have difficulties in understanding the difference between Knowledge-based IDS and behavior-based IDS.

This link says that a knowledge-based IDS uses a database of specific attacks and system vulnerabilities, which is blacklist method, I think. But what about a IDS that uses whitelist? Is this IDS still a Knowledge-based IDS? (or a behavior-based IDS?)

Here is an example of a simple IDS, can someone tell me is this IDS a Knowledge-based IDS or a behavior-based IDS?


A simple IDS has a whitelist of all allowed personnel. And the whitelist looks like [alice, bob].

When alice or bob comes, no alarm is sound. But when jack comes, the intrusion alarm is triggered.

(you can also think alice, bob and jack as network packet IDs)

So, knowledge-based? behavior-based?

  • You defined "knowledge-based" but never defined "behaviour-based". If you define what a behaviour is, you might find your own answer.
    – schroeder
    Commented Apr 26, 2017 at 6:52
  • I also think you are confusing IDS (detecting bad things) and IPS (stopping bad things).
    – schroeder
    Commented Apr 26, 2017 at 6:53
  • @schroeder thanks for replying. I looked up the definition of "behavior-based IDS", and the definition is "detect the deviation from normal/expected behavior". So I'm thinking the simple IDS in my question should be categorized as Behavior-based IDS. Agree?
    – Fei
    Commented Apr 26, 2017 at 7:04

1 Answer 1


Knowledge-based is like a signature-based anti-virus: you populate a database of "badness" and look for those things.

Behaviour-based learns what is normal for the network over time, then alerts on things that are "weird".

Your whitelist approach is still "knowledge-based" because you populate the whitelist database. A behaviour-based approach would learn that Alice and Bob are normal users by watching the traffic.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .