Diversification is intended to create a moving target and render ineffective the accumulation of system knowledge as an intrusion strategy. Diversification also eliminates intrusion opportunities associated with multiple nodes that execute identical software and typically exhibit identical vulnerabilities. Such systems offer tempting economies of scale to intruders, since when one node has been penetrated, all nodes can be penetrated. Requirements for diversification can include variation in programs, retained data, and network routing and communication. Recognition Service Requirements.
Recognition is the capability of a system to recognize attacks or the probing that precedes attacks.
The ability to react or adapt during an intrusion is central to the capacity of a system to survive an attack that cannot be completely repelled. To react or adapt, the system must first recognize it is being attacked. In fact, recognition is essential in all three phases of attack. Anomaly detection is based on models of normal user behavior. These models are often established through statistical analysis of usage patterns.