Is there any difference between them? On google, I can find many description about anomaly based IDS. But I can not find any description about protocol state based IDS.

  • 2
    Show your efforts before asking such question. – tech_enthusiast Mar 6 '18 at 3:57

As you may have discovered, anomaly-based intrusion detection systems work by developing a profile of normal activity and flagging "attack traffic" that deviates from its profile. One of the downsides of this type of IDS is that it may have a high rate of false-positives; that is, it may incorrectly report that an attack has taken place.

Protocol-based intrusion detection systems (PIDS) take a different approach. Specifically, they are installed on a web server and used to monitor and analyze the protocol (rather than the profile of normal activity it has built) used by that computing system. The advantage here is that protocols are relatively well-defined (in comparison to "normal activity" profiles), so normal use cases can be created with greater accuracy. One example is monitoring an HTTP/HTTPS stream. The downside is that this causes increased computing on the web server, but provides greater protection.

This article does a good job explaining Protocol Anomaly Detection: https://www.sans.org/reading-room/whitepapers/detection/protocol-anomaly-detection-network-based-intrusion-detection-349

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.