Making IT simple! 0844 344 1979

Papers and Articles

Combination of Misuse and Anomaly Network Intrusion Detection Systems

This project was completed in March 2002 during time studying at the University of York's Department of Computer Science. Intrusion Detection Systems detect attackers and respond to them in real time. This paper investigates combining two different approaches to intrusion detection in one system.

Misuse detection consists of defining malicious network traffic and monitoring for it. Anomaly detection consists of defining normal or typical network traffic and then detecting anything else. The PERL source code for a prototype NIDS is included (requires TCPDump).

Download this paper here. (Adobe Reader required. Get it here)

Download the source code here.

View this paper as a normal web page.