A SURVEY ON NETWORK ATTACKS, CLASSIFICATION AND MODELS FOR ANOMALY-BASED NETWORK INTRUSION DETECTION SYSTEMS

The importance of network security has grown tremendously and a number of devices have been introduced to improve the security of a network. Network Intrusion Detection Systems (NIDS) are among the most widely deployed such system. Popular NIDS use a collection of signatures of known security threats and viruses, which are used to scan each packet's payl oad. Most IDSs lack the capability to detect novel or previously unknown attacks. A special type of IDSs, called Anomaly Detection Systems, develop models based on normal system or network behavior, with the goal of detecting both known and unknown attacks. Anomaly detection systems face many problems including high rate of false alarm, ability to work in online mode, and scalability. This paper presents a selective survey of incremental approaches for detecting anomaly in normal system and network traffic