Re: Important Comments re: INtrusion Detection

[Vern Paxson <vern () ee lbl gov>]

> How about time series analysis of request 
> response cycles, or statistical analysis of larger traffic patterns?  

I'm skeptical that you can reliably detect attackers this way.  A theme
from the measurement studies I've done is that many aspects of "normal"
traffic have an extremely large range of behavior; so it seems all-to-easy
for an attacker to shape their illicit traffic to fit somewhere within that
wide range, and therefore go undetected.

                Vern