To react or adapt, the system must first recognize it is being attacked. In fact, recognition is essential in all three phases of attack. Anomaly detection is based on models of normal user behavior. These models are often established through statistical analysis of usage patterns. Deviations from normal usage patterns are flagged as suspicious.
Pattern recognition is based upon models of intruder behavior.
User activity that matches a known pattern of intruder behavior raises an alarm. A system or component that understands what it is being asked can refuse requests that would be dangerous, compromise a security policy, or adversely impact the delivery of minimum essential services. Detection of signs of intrusion would trigger an immediate test of trust relationships. This analysis can help to prevent other components from suffering the same fate. A survivable-system design must include explicit requirements for recognition of attack.