A brief observation-centric analysis on anomaly-based intrusion detection

Zonghua Zhang, Hong Shen

Research output: Contribution to journalConference articlepeer-review

2 Citations (Scopus)


This paper is focused on the analysis of the anomaly-based intrusion detectors' operational capabilities and drawbacks, from the perspective of their operating environments, instead of the schemes per se. Based on the similarity with the induction problem, anomaly detection is cast in a statistical framework for describing their general anticipated behaviors. Several key problems and corresponding potential solutions about the normality characterization for the observable subjects from hosts and networks are addressed respectively, together with the case studies of several representative detection models. Anomaly detectors' evaluation are also discussed briefly based on some existing achievements. Careful analysis shows that the fundamental understanding of the operating environments is the essential stage in the process of establishing an effective anomaly detection model, which therefore worth insightful exploration, especially when we face the dilemma between the detection performance and the computational cost.1

Original languageEnglish
Pages (from-to)178-191
Number of pages14
JournalLecture Notes in Computer Science
Publication statusPublished - 2005
Externally publishedYes
EventFirst International Conference on Information Security, Practice and Experience, ISPEC 2005 - , Singapore
Duration: 11 Apr 200514 Apr 2005


Dive into the research topics of 'A brief observation-centric analysis on anomaly-based intrusion detection'. Together they form a unique fingerprint.

Cite this