When implementing anomaly-based intrusion detection system, if I want to dismiss U2R and R2L attacks (to avoid deep packet inspection), and to consider only Probe and DoS attacks, what features should I consider? Should I consider the network anomaly papers or intrusion-based papers?

As I learned, there are papers considering detecting network anomalies (link outage, large file transfers,... as well as DoS, Probe attacks) and there are papers considering detection of intrusions (DoS, Probe, U2R, and R2L attacks).

Are the former papers the special case of latter ones? I mean the feature space used for them are a subset of the latter one?

  • If this is more than a toy research project, you need to seriously look into performance. Even signature based IDS have troubles processing > 100 Mbps. When anomaly checking comes in, you'll be choking on 10Mbps or lower. Commented Nov 22, 2012 at 23:39

1 Answer 1


First response, please don't flame :-)

If I understand your question correctly then yes you could think of attacks as a sub-set of anomalies. In some cases this is useful, but not terribly. If, for example, you have a very quiet network segment that never sees any traffic and all of a sudden you get slammed. The traffic change is an anomaly that could be an intentional DoS, or maybe you just put your website on search-engine-x and it finally got some traffic. The reality of the situation is contextual, one of the reasons that tuning your firewalls/ips/ids/etc is so important. It would be my advice to look at both independently and also consider them holistically. Tune, adjust, refine.

From an analysis point of view you would even say that consistent attacks, ie the standard, which suddenly disappear would also raise a red flag. Posit: your network has been getting low level probes from a specific IP range for a month straight. These types of nuisance scans are often over-looked but today, for no reason that you can tell, they stop. This is an anomaly for the network traffic patterns, but is it a good or a bad thing?

As to the last part; malignant network activity (DoS, Probes) and intrusion detection (looking at u2r/r2l/etc activities) are two different classes of detection analysis.

There is a decent paper on this at http://cs.fit.edu/~mmahoney/dist/ although it's a little dated I think it is still salient to your question.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .