Signature-based NIDS

• Limitations of signature descriptions/matching limit effectiveness

• Most systems/signatures only examine individual packets

  • Stateless

• Some systems consider multiple packets

  • Rate, multi-packet pattern-match, ...