Recognition Service Requirements. Recognition is the capability of a system to recognize attacks or the probing that precedes attacks. The ability to react or adapt during an intrusion is central to the capacity of a system to survive an attack that cannot be completely repelled. To react or adapt, the system must first recognize it is being attacked. In fact, recognition is essential in all three phases of attack.
Anomaly detection is based on models of normal user behavior.
These models are often established through statistical analysis of usage patterns. Deviations from normal usage patterns are flagged as suspicious. Pattern recognition is based upon models of intruder behavior. User activity that matches a known pattern of intruder behavior raises an alarm. A system or component that understands what it is being asked can refuse requests that would be dangerous, compromise a security policy, or adversely impact the delivery of minimum essential services.