“Learning” NIDS

• Idea: Use AI techniques to “learn” about expected (good) traffic

  • Anything else is a potential attack

• Mostly still a research topic

• Hard to provide accurate training data

  • How do you know there isn't an attack in progress?