RE: IDS

[ajcblyth () glam ac uk (Comp)]

Greetings,

> How can I detect UNKOWN attacks if they are unknown ???

Well, If you log all data then you can apply various technqiues to it and
see what falls out.  In the elimination of noise from an audio environment,
one particularly useful technique is to isolate the ambient, background
noise and to remove that from the signal presented to the recording or
amplifying system. This presents a notion for the approach of using
normalisation on the hostile network traffic: we isolate the non-ambient
hostile traffic by removing the traffic that is visible in 'the background'.

Regards

Andrew.