This paper examines intrusion detection systems, and in particular, network-based systems. Intrusion detection systems are commonly classified by the type of analysis they perform, such as misuse versus anomaly detection. They can also be classified according to the source and type of information they collect, such as host-based versus network-based. This paper compares and contrasts the
... [Show full abstract] difference between these classifications examining in detail two network-based systems that are commonly in use, Net Ranger and Network Flight Recorder.