A recommended framework for anomaly intrusion detection system (IDS)

Signature-based solutions for Intrusion Detection are dominant in practice despite of its incapability to detect zero-day attacks. Moreover, anomaly-based Intrusion Detection Systems (IDS), a promising approach against both known and unknown attacks, are not mature for a broad productive use. Therefore, the further development of anomaly based IDS is an imperative task to strengthen security in todays networked infrastructure. This motivates a detailed study to give a structured view of problems and challenges and of the current state in this field. For this purpose, a sound analysis of current limitations and a very comprehensive survey of research papers have been conducted. In this article, a short summary of the results of the survey is given. Furthermore, the survey led to important insights into future research efforts and a proposal for a promising future IDS architecture, which is presented in this work.