异常检测和行为检测之间的区别
在入侵检测系统中，有两种技术，称为异常检测和行为检测。我正在从头开始实施 IDS，并检查一些签名，并且从某些站点将它们作为不同类型的检测方法给出。它们的基本区别是什么？在我看来，两者是相同的，因此相同的签名应该能够检测到此类攻击。
网站上给出的异常检测示例：检测不属于正常配置文件一部分的函数
调用 网站上给出的行为检测示例：搜索 cmd.exe 的任何远程调用。
现在在我看来，两者都是相同的事情，即偏离正常行为，那么为什么它们被描述为不同的方法呢？
In an Intrusion Detection System, There are two techniques called Anomaly Detection and Behaviour Detection. I am implementing an IDS from scratch and was checking for some signatures and from some site they were given as different types of methods for detection. What is the basic difference in them? As it seems to me that both are same and therefore same signatures should be able to detect these kind of attacks.
Example for Anomaly detection as given on the site: Detecting a function call that is not part of the normal profile
Example for Behaviour detection as given on the site: Searching for any remote invocation of cmd.exe.
Now as it seems to me that both are kind of same things i.e. deviation from normal behaviour so why they were characterised as different methods??
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
基于异常的检测和行为检测之间确实存在差异。在探讨两者之前，我想指出
入侵检测社区使用两种附加样式：基于误用（又名基于签名）和基于规范检测，但这些与您的问题无关。
基于异常的检测
定义：一种两步方法，首先使用数据训练系统以建立某种正常性概念，然后使用针对实际数据建立的配置文件来标记偏差。
示例：查看良性 URL 的一些特征，例如它们的长度、字符分布等，以找到“正常”URL 的定义。有了这种正常性的概念，您就可以标记那些与正常 URL 长度相差太远或其中包含太多异常字符的 URL。
优点：
缺点：
基于行为的检测
定义：寻找< em>证据妥协而不是攻击本身。
示例：监视
unset HISTFILE的 shell 历史记录，该命令通常只有攻击者在破坏计算机后才会输入。优点：
缺点：
There is indeed a difference between anomaly-based and behavioral detection. Before exploring the two, I would like to point out that the
intrusion detection community uses two additional styles: misused-based (aka. signature-based) and specification-based detection, yet these are unrelated to your question.
Anomaly-based detection
Definition: A two-step approach that involves first training a system with data to establish some notion of normality and then use the established profile on real data to flag deviations.
Example: look at some features of benign URLs, e.g., their length, character distribution, etc., to find define what a "normal" URL looks like. With this notion of normality, you would then flag URLs that are too far off the normal URL length or have too many abnormal characters in them.
Pros:
Cons:
Behavior-based detection
Definition: Looking for evidence of compromise rather than the attack itself.
Example: monitor the shell history for
unset HISTFILE, a command that typically only attackers enter after compromising a machine.Pros:
Cons:
事实上，“基于异常的检测”和“基于行为的检测”并没有什么不同。行为检测通常可以在供应商的数据表中找到，它们指的是他们观察/反馈给检测引擎的通信模式（及其功能）。
Indeed "anomaly-based detection" and "behavior-based detection" are not different. Behavior detection is usually found in vendors' datasheets, and they refer to the communication patterns (and their features) they observe/feed the detection engine with.
IDS 的两种主要类型是基于签名的和基于异常的。区别很简单：基于签名的 IDS 依赖于已知攻击的数据库，而基于异常的 IDS 则观察网络行为，分析正常行为，并且在出现任何异常的情况下，这些异常会导致其发出警报的偏差。
The two main types of IDS are signature-based and anomaly-based. The difference is simple: signature-based IDS rely on a database of known attacks, while anomaly-based observe the behavior of the network, profile the normal behavior, and in the case of any anomalies, these anomalies cause deviations on which it alerts.
基于行为的检测不同于基于异常的检测。
基于行为的检测记录有关受监控实体的预期模式（例如用户登录）。
基于异常的检测根据对正常情况的观察，规定了预期模式的基线。
Behavioral-based detection differs from anomaly-based detection.
Behavioral-based detection records expected patterns concerning the entity being monitored (ex. user logins).
Anomaly-based detection prescribes the baseline for expected patterns based on its observation of what normal looks like.