[ITChief]

Are there advantages of signature based vs. behavior based systems?

[kewlkreator]

What?

Please remove this. Wrong forum

[BetaWar]

Moved to Comp Sci.

[skyhawk133]

I'm actually going to stick it in Networking as it's more of a networking topic. Or I could just close it since the OP couldn't take the time to even explain what he was interested in or provide any context for his post.

[kewlkreator]

Well stop torchering the guy! XD

[no2pencil]

I would think you would want behavior based. Because signatures can be avoided or faked.

[mattman059]

Wow...i did my senior seminar paper on IDSs... okay well

first things first ...Neither system is perfect

As no2Pencil said signatures can indeed be faked, but behavior based systems share a similar con. An attacker can slowly infiltrate himself into a system, performing small insignificant acts that get through the IDS like pings and trace routes and such. Over time the system begins to learn that these are normal activities, and when these activities are thought of as normal, the attacker can then flood the system with ping packets and thus you have a DoS attack on the server. The best kind of intrusion detection system is one that (in my opinion) is one that uses behavior based tactics coupled with a well designed Data Mining engine or Neural Network structure so that it can rank the level of "normal-ness" through the use of fuzzy logic. So that over time if the number of ping requests increases, the log will show that for example one day a ping with 10 packets showed as 10% normal however three days later a ping with 100 packets could be shown as 2% normal flagging the event and hopefully preventing any further attempts to flood the server.