NIDS Weaknesses

• Hard to distinguish between attempted attack and successful attack

  • Requires keeping state
  • Requires more sophisticated signature definitions and matching tools

• Need to customize ruleset to each site

• Need to keep ruleset up-to-date with current vulnerabilities and attacks ...