Anomaly detection (cont.)

• Statistical profiling
  • comprise profiles of normal behaviour from various statistical measures

• Example systems
  • NSWC SHADOW, various SYN flood detectors, UC Davis GRIDS

• Problems
  • insensitive to event ordering
  • threshold determination - just outside std.deviation, or other specific abnormality threshold values?
  • easy to slide ``under the radar'' when there exists a wide range in normal behaviour