Two Approaches:

• Rule-based Detection

• Attempt to define set of rules that determine intruder’s behavior

  • Anomaly detection: detect deviation from previous usage patterns
  • Penetration identification: expert system that searches for suspicious behavior

• Better approach for detecting penetration