Editing Intrusion detection system (section)

=== Detection methods ===
The majority of intrusion prevention systems utilize one of three detection methods: signature-based, statistical anomaly-based, and stateful protocol analysis.{{r|WhitmanMattord2009|page1=301|KirdaJha2009}}

# '''Signature-based detection''': Signature-based IDS monitors packets in the Network and compares with pre-configured and pre-determined attack patterns known as signatures. While it is the simplest and most effective method, it fails to detect unknown attacks and variants of known attacks.<ref name="Liao 16–24">{{Cite journal |last=Liao |first=Hung-Jen |last2=Richard Lin |first2=Chun-Hung |last3=Lin |first3=Ying-Chih |last4=Tung |first4=Kuang-Yuan |date=2013-01-01 |title=Intrusion detection system: A comprehensive review |url=https://www.sciencedirect.com/science/article/pii/S1084804512001944 |journal=Journal of Network and Computer Applications |volume=36 |issue=1 |pages=16–24 |doi=10.1016/j.jnca.2012.09.004 |issn=1084-8045}}</ref>
# '''Statistical anomaly-based detection''': An IDS which is anomaly-based will monitor network traffic and compare it against an established baseline. The baseline will identify what is "normal" for that network – what sort of bandwidth is generally used and what protocols are used. It may however, raise a False Positive alarm for legitimate use of bandwidth if the baselines are not intelligently configured.<ref name="Whitman">{{cite book
 |last1 = nitin.
 |first2 = verma
 |last2 = Mattord
 |title = Principles of Information Security
 |pages = [https://archive.org/details/principlesofinfo0000whit/page/290 290–301]
 |publisher = Course Technology
 |year = 2008
 |isbn = 978-1-4239-0177-8
 |url = https://archive.org/details/principlesofinfo0000whit/page/290
 }}
</ref> Ensemble models that use Matthews correlation co-efficient to identify unauthorized network traffic have obtained 99.73% accuracy.<ref>{{cite book |last1=Nti |first1=Isaac Kofi |last2=Nyarko-Boateng |first2=Owusu |last3=Adekoya |first3=Adebayo Felix |last4=Arjun |first4=R |title=2021 22nd International Arab Conference on Information Technology (ACIT) |chapter=Network Intrusion Detection with StackNet: A phi coefficient Based Weak Learner Selection Approach |date=December 2021 |pages=1–11 |doi=10.1109/ACIT53391.2021.9677338 |isbn=978-1-6654-1995-6 |s2cid=246039483 }}</ref>
# '''Stateful protocol analysis detection''': This method identifies deviations of protocol states by comparing observed events with "pre-determined profiles of generally accepted definitions of benign activity".{{r|WhitmanMattord2009}} While it is capable of knowing and tracing the protocol states, it requires significant resources.<ref name="Liao 16–24"/>