## 6 Hardware and Software for Data Protection
### Types of IDS
#### 6.3.4 Machine Learning
[PERSON]'s research mentioned earlier gave useful insights to network and security managers of businesses who are considering the incorporation of ML concepts into network intrusion detection, where trade-offs between performance and resource consumption are crucial [42]. Signature-based approaches are very good at identifying attacks that are well known. However, they are not capable of detecting new, unfamiliar intrusions, even if they are built as minimum variants of already known attacks [43]. There are many anomaly-based approaches according to [PERSON] et al. [44], which can be summarised in the basic modules in the model shown in Figure 5 below. Figure 5 above shows an adaptation of the model represented in a figure of how the interaction works between the various models diagram extracted from [PERSON] et al. The three main models indicated are Parameterization, Training Module and the Detection modules as explained below. 1. Parameterization: The target is represented in a pre-established form. 2. Training stage: The normal (or abnormal) behaviour of the system is characterized, and a corresponding model is built. 3. Detection stage: Once the model for the system is available, it is compared with the (parameterized) observed traffic. If the deviation is found to exceed, an alarm will be triggered. Together with the above NIDs model, there are three approaches that are used to monitor the target and establish its detection rules. These three techniques are Statistical-Based, Knowledge-Based and Machine Learning. The first one falls under Statistical-Based Techniques whereby the network traffic activity is captured and a profile representing its stochastic behaviour is created. This profile is based on metrics such as the traffic rate, the number of packets for each protocol, the rate of connections, the number of different IP addresses, as described in this particular study by [PERSON] et al. [44]. The second technique known as the Knowledge-Based expert system approach is one of the most widely used knowledge-based IDS schemes. However, expert systems can also be classified into other, different categories according to [PERSON] and [PERSON] [45; 46]. Figure 5: Generic Anomaly model of NIDS [44]. These expert systems classify the audit data according to a set of rules, attributes, and classes from the training data. Then, it breaks them down again into a set of classification rules, parameters, or procedures. The audit data are classified accordingly. The third technique which holds the highest precedence is the highly researched Machine Learning techniques. This method is based on establishing an explicit or implicit model that enables the patterns analysed to be categorized. A singular characteristic of these schemes is the need for labelled data to train the behavioural model, a procedure that places severe demands on resources. Its behavioural models are so advanced with flavours of Bayesian networks (probabilistic relationships among variables), Markov models (stochastic Markov theory), Neural networks (human brain foundations), Fuzzy logic (approximation and uncertainty), Genetic algorithms (evolutionary biology inspired) and Clustering and outlier detection (data grouping) to name the top used [40]. Although anomaly-based detection techniques are not yet mature, they are beginning to appear in commercial and OpenSource products. IDS software tools in this line with Anomaly Techniques include SNORT (www.snort.org (accessed on 15 January 21)) and pfSense [47; 48]. Companies that are seeing a growth in pioneering technology include Cisco Intrusion Prevention, McAfee IntraShield Network Intrusion Prevention and Checkpoint IPS-1, which all constitute integral network security solutions [49]. To have a complete anomaly-based technique in its current academic research state has its advantages.