Методи виявлення у системах виявлення вторгнень

Abstract

This work focuses on intrusion detection systems (IDS) used to identify malicious activities in computer systems and networks. The main types of IDS, namely, network-based (NIDS) and host-based (HIDS), are considered. The key detection methods, including signature-based and anomaly-based approaches, are analyzed. The advantages and limitations of each method are discussed, with particular attention to the adaptability of anomaly detection in identifying new and unknown threats. The role of IDS in modern cybersecurity infrastructure is highlighted, demonstrating its importance in threat detection and mitigation.