2. Analysis technologies

2.1 Scenario-based detection

Scenario-based detection is based on accumulated knowledge of attacks and specific vulnerabilities in information systems, operating systems and applications. The intrusion detection system contains information on these vulnerabilities and searches for attempts to exploit them. When such an attempt is detected, an alert is generated.

In other words, any action that is not explicitly identified as a misuse of the information system is considered acceptable. Note that scenario-based detection covers more than just known attacks. A security policy can explicitly declare events as "undesirable" without any associated vulnerability. For example, certain protocols such as SNMP can be banned from a network regardless of any vulnerability....