Towards a Taxonomy of Intrusion-Detection Systems

Intrusion-detection systems aim at detecting attacks against computer systems and networks. As it is difficult to provide provably secure information systems, intrusion-detection systems have the task of monitoring the usage of such systems. They detect attempts by users of the information systems or external parties to abuse their privileges or exploit security flaws. In this paper, we introduce a taxonomy that highlights the various aspects of this area. This taxonomy divides families of intrusion-detection systems according to their properties. It is illustrated by numerous examples from past and current projects.