This includes the recognition of novel attacks and methods. The fundamental problem in IDS design is really how to recognize the behavior associated with intrusions. A determined attacker effects his intrusion through a sequence of activities to achieve a desired result. Generally, each of these actions, viewed by itself is a normal legitimate activity. It is only when the sequence of an attack is assembled that the intruder's hostile objectives become clear.
Intrusions can come in many ways.
Consider the type of intruder in Figure 4 who is conducting a systematic focused attack on a network over the Internet. Although this is not the only type of intruder, this is potentially one of the most dangerous. He has a source from which he is attempting to accomplish his malicious objectives using some initial knowledge of the target system. Sources Targets Objectives Actions Knowledge Methods Figure 4. DSP methods include both digital filters, and spectrum analysis.