Intrusion detection system models

The recent dramatic increase in the number of malicious Internet and computer attacks has prompted a great interest in the research of intrusion detection (ID). As the first line of defense for computer and network systems, intrusion detection systems (IDSs) have been deployed more and more widely. Behind each IDS is an intrusion detection model which dictates to some extent the capability and the performance of the system. In this paper, we examine, analyze, and compare the prominent intrusion detection models from the literature in order to show the state-of-the-art IDS technology. ID models are based on two distinct detection approaches: misuse detection and anomaly detection. This paper also discusses how to select ID models for intrusion detection system development and throws light on the direction of further research in ID.