5

I'm having trouble understanding the difference between NIDS (Network-based Intrusion Detection System) and NBA (Network Behavior Analysis)

It is to my understanding that

NIDS use two detection methods :

  • Signature-based detection
  • Anomaly-based detection

and NBA use one detection method :

  • Anomaly-based detection

Both use network "Anomaly-based" detection and both analyse the same kind of sample (packets). Note that NIDS also has a Signature-based detection. Is NBA just a lighter version of NIDS or is there a difference in the way it does Anomalyse-based detection ?

4

NIDS are designed to inspect the network at certain points, like at ingress/egress points in the network. Its focus is intrusion. Yes, there are signature rules and there are anomaly rule sets, but they focus on the point where traffic passes the NIDS inspection point.

NBA looks at the network. It's looking at bandwidth and protocol use and other factors across the network. It can gather data from across all network devices and work out what is weird/unusual.

And, as per usual in this field, definitions will mutate and change over time as both technologies start to "meet in the middle" and do each other's jobs.

  • Can we consider that NIDS is more stateless that NBA because NIDS is more about performing a packet inspection at instant t while NBA is more statefull and try to correlate packets together ? – Xavier59 Oct 28 '19 at 15:34
  • No, you can't go that far – schroeder Oct 28 '19 at 16:02
  • I'm still not sure I get the difference then. Especially, I do not get this sentence : Yes, there are signature rules and there are anomaly rule sets, but they focus on the point where traffic passes the NIDS inspection point. Could you rephrase it ? – Xavier59 Oct 28 '19 at 16:07
  • 1
    It's the difference between a microscope and a scanner. One inspects the details and makes conclusions. The other takes in a broad understanding and makes conclusions. – schroeder Oct 28 '19 at 16:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.