# Machine Learning and Deep Learning Methods for Intrusion Detection Systems: A Survey
## 2 Concept and Taxonomy of IDS
### Classification by Source of Data  
An advantage of a host-based IDSs is that it can locate intrusions precisely and initiate responses because such IDSs can monitor the behaviors of significant objects (e.g., sensitive files, programs and ports). The disadvantages are that host-based IDSs occupy host resources, are dependent on the reliability of the host, and are unable to detect network attacks. A network-based IDS is usually deployed on major hosts or switches. A majority of network-based IDSs are independent of the operating system (OS); thus, they can be applied in different OS environments. Furthermore, network-based IDSs are able to detect specific types of protocol and network attacks. The drawback is that they monitor only the traffic passing through a specific network segment. The main differences between host-based IDS and network-based IDS are listed in Table 2.  
As shown in Figure 1, a host-based IDS uses audit logs as a data source. Log detection methods are mainly hybrids based on rule and machine learning, rely on log features, and use text analysis-based methods. A network-based IDS uses network traffic as a data source--typically packets, which are the basic units of network communication. A flow is the set of packets within a time window, which reflects the network environment. A session is a packet sequence combined on the basis of a network information 5-tuple (client IP, client port, server IP, server port, protocol). A session represents high-level semantic information of traffic. Packets contain packet headers and payloads; therefore, packet detection includes parsing-based and payload analysis-based methods. Based on feature  
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline  & **Misuse Detection** & **Anomaly Detection** \\ \hline
**Detection performance** & Low false alarm rate; High missed alarm rate & Low missed alarm rate; High false alarm rate \\ \hline
**Detection efficiency** & High, decrease with scale of signature database & Dependent on model complexity \\ \hline
**Dependence on domain knowledge** & Almost all detections depend on domain knowledge & Low, only the feature design depends on domain knowledge \\ \hline
**Interpretation** & Design based on domain knowledge, strong interpretative ability & Outputs only detection results, weak interpretative ability \\ \hline
**Unknown attack detection** & Only detects known attacks & Detects known and unknown attacks \\ \hline \hline \end{tabular}
\end{table}
Table 1: Differences between misuse detection and anomaly detection.  
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline  & **Host-Based IDS** & **Network-Based IDS** \\ \hline
**Source of data** & Logs of operating system or application programs & Network traffic \\ \hline
**Deployment** & Every host; Dependent on operating systems; Difficult to deploy & Key network nodes; Easy to deploy \\ \hline
**Detection efficiency** & Low, must process numerous logs & High, can detect attacks in real time \\ \hline
**Intrusion traceability** & Trace the process of intrusion according to system call paths & Trace position and time of intrusion according to IP addresses and timestamps \\ \hline
**Limitation** & Cannot analyze network behaviors & Monitor only the traffic passing through a specific network segment \\ \hline \hline \end{tabular}
\end{table}
Table 2: Differences between host-based and network-based IDSs.  
extraction, flow detection can be divided into feature engineering-based and deep learning-based methods. In addition, traffic grouping is a unique approach in flow detection. Based on whether sequence information is used, session detection can be divided into statistical feature-based and sequence feature-based methods.