Anomaly Detection in Intrusion Detection Systems
摘要
By nursing systems and network circulation to identify anomalies and threats, intrusion detection systems are indispensable components of network security. This study examines various types of Intrusion Detection System, including host-based and network-based, and discusses the appropriate deployment con-texts for each. The utilization of anomaly detection techniques within Intrusion Detection System significantly enhances the ability to detect novel and unknown threats that evade signature-based detection methods. This review highlights practical approaches for developing anomaly detection models, encompassing various methodologies, including machine learning techniques for example neural networks and statistical methods for outlier detection. It highlights the importance of data collection and preparation, with a particular focus on feature engineering. Both supervised and unsupervised approaches are examined, including density estimation and clustering techniques. The review highlights the importance of utilizing performance metrics and test datasets to assess the effectiveness of various anomaly detection strategies. It addresses challenges such as concept drift and the curse of dimensionality that may impact model performance. Furthermore, the integration of explainable artificial intelligence and deep learning into anomaly detection is identified as an emerging trend. This comprehensive research explores how anomaly detection facilitates threat identification within security systems, presents a variety of methodologies and algorithms, reviews evaluation procedures, and discusses the limitations and challenges within the field. Additionally, it offers insights for future research aimed at enhancing network security through more effective detection of anomalous activities.