Summary

---

A lack of a mathematical basis of intrusion detection systems prevents researchers from developing efficient intrusion detection methods. All existing methods are based either on the developer's individual preferences or on scientific achievements in related areas. The existing tools and mechanisms currently have no solid scientific basis, which does not allow the user to confirm or rule out the proposed solutions. Currently, there are some positive trends in this area; however, all research works are very far from being accomplished.

Thus, in this chapter we have described three basic principles representing the foundation for all intrusion detection technologies. Now we know what, where and how to detect. There are two methods of using this knowledge in practice. First, you can manually apply the simplest methods of analysis to find the known attack indications. This approach will be covered in Chapter 5. The second approach requires the same actions to be performed in automatic mode. This approach will be covered in Chapters 6 through 12.

---