# A Local Feature Engineering Strategy to Improve Network Anomaly Detection +
## 3 Background
### Intrusion Detection Systems
#### 3.1.1 Operative Ways  
Although there are many ways to classify the IDSs, one of the most used in the literature classifies them into four categories: anomaly-based network IDSs, signature-based network IDSs, specification-based network IDSs, and Hybrid-based network IDSs. They are summarized as follows:  
* _Anomaly-based network IDSs_, also named behavior-based network IDSs, operate by analyzing and classifying each network event in two classes, normal or intrusion. Instead of performing a process of comparison between the new network events and a database that contains the signatures/patterns related to the known ones, the classification process exploits a heuristic or rules-based strategy aimed to detect the intrusion in terms of events not attributable to a normal network activity. It should be noted that, despite the huge research effort in this area, as well as the huge number of such systems formalized in the literature, problems to be solved continue to exist [56];
* _Signature-based network IDSs_, also named knowledge-based network IDSs, operate by comparing the pattern of each new network event to a database of known signatures/patterns [57]. In [58], the authors proposed to face the problem related to the significant overheads in terms of memory usage and execution time related to the signature/pattern matching operation by parallelizing the process on a multi-core CPU.
* _Specification-based network IDSs_, also named stateful protocol analysis network IDSs, operate by knowing and tracing the involved protocol states with the objective to detect unexpected sequences of commands [59]. The related disadvantages are the computational load that needs for the protocol state tracing and analysis and their inability to inspect attacks based on the same behavior of the normal network activities. An example of this category of IDSs can be found in [60], where the protocol packets are examined to detect malicious payloads.
* _Hybrid-based network IDSs_ operate by mixing the aforementioned approaches with the goal to improve the detection performance, according to a specific objective/scenario [61]. An example is the work proposed in [62], where the authors formalized a hybrid of anomaly-based and specification-based IDS aimed to operate in the context of an IoT environment.  
On the basis of the researchers' experience reported in the literature, the main pros and cons of the aforementioned approaches are summarized in Table 1.  
\begin{table}
\begin{tabular}{l l l} \hline \hline
**Approach** & **Pros** & **Cons** \\ \hline \multirow{4}{*}{_Anomaly-based_} & Capability to detect zero-days attacks; & \multirow{4}{*}{\
\begin{tabular}{} \end{tabular} } \\  & effectiveness to detect misuse of privileges; & Low accuracy given by the high dynamicity \\  & not completely dependent from the & of the network events; latency that does not \\  & operating system & allow the system to operate in real-time \\ \hline \multirow{4}{*}{_Signature-based_} & \multirow{4}{*}{
\begin{tabular}{} \end{tabular} } & Inability to detect unknown attacks and \\  & & variations of the known ones; inability to \\ \cline{1-1}  & & analyze the protocols states; difficulty to \\ \cline{1-1}  & & keep updated the signatures/patterns \\ \cline{1-1}  & database; high computational cost \\ \hline \hline \end{tabular}
\end{table}
Table 1: Pros and cons of IDS operative approaches.