IDS Technique

Advantages

Limitations

Signature-based IDS

1) High accuracies in detecting known attacks

2) Offers low computational costs

3) Easy to track and stop an attack since log files are exhaustive

1) Cannot track down intelligent intrusions.

2) New attacks have to be updated in the database

3) Huge traffic limits the inspection of every packet causing unattended packets to pass through

Anomaly-based IDS

1) Higher the false alarm rate for unknown attacks

2) New threats are easily detectable without updating the database

3) System is self learning. It gradually learns the network and builds profile

4) The more it is used the higher the accuracy level

1) While building profile, a network is left in an unmanaged state hence prone to attack

2) When malicious activities assume the features of normal traffic it is untraceable.

3) Collected behavior and features determine the accuracy of detection

Fuzzy logic IDS

1) Increased flexibility in addressing uncertain problems

1) Offers low accuracy levels compared to ANN

SVM based IDS

1) Correctly classifies intrusions even with limited sample data

2) Ability to handle huge number of features

1) Classifies only distinct features hence the features have to be preprocessed before their application

Genetic algorithm IDS

1) Offers best detection features

2) Has better efficiency

1) Very complex

2) Its usage is of specific pattern as opposed to a general pattern

ANN based IDS

1) Effectively classifies unstructured network packets

2) Classification efficiency achieved by introducing multiple hidden layers

1) Requires a lot of time at the training phase

2) Has lesser flexibility

3) Effective training requires larger data samples

Hybrid Techniques

1) Efficient as it combines multiple techniques to accurately classify rules

1) Its computational costs are high