## Detection Methods: Signatures vs. Anomaly

How does an IDS know a packet is "bad"?

### 1. Signature-Based Detection (The Database)
This is the traditional method. The IDS compares packets against a huge database of known attack patterns (Signatures).
*   **Example**: "If a packet contains the hex bytes `0x90909090` (NOP Sled), alert."
*   **Pros**:
    *   Low False Positives (Usually).
    *   Fast.
    *   Specific (Tells you exactly what the attack is: "EternalBlue Exploit").
*   **Cons**:
    *   Can only detect *known* attacks.
    *   Useless against 0-days (Brand new exploits).

### 2. Anomaly-Based Detection (The Baseline)
Also called "Behavioral". The IDS learns what "Normal" traffic looks like.
*   **Learning Phase**: "On Mondays, the Marketing Server sends 50MB of data to the Printer."
*   **Detection**: "Today (Monday), the Marketing Server sent 50GB of data to an IP in China." -> ALERT.
*   **Pros**:
    *   Can detect 0-days and unknown attacks (because the behavior is weird).
*   **Cons**:
    *   **High False Positives**. (Maybe the Marketing team is doing a backup? Maybe they hired a new guy who works weird hours?).
    *   Requires a "Training Period" where the network must be clean (don't train on infected traffic!).

### 3. Protocol Verification
The IDS knows how protocols (HTTP, DNS, TCP) *should* work.
*   **Rule**: "In HTTP, the Header must end with two newlines."
*   **Attack**: An attacker sends a malformed header to crash the server.
*   **Detection**: The IDS sees the protocol violation and alerts, even without a specific signature for that specific exploit tool.

### The Modern Approach
Most modern systems use **Hybrid Detection**. They use Signatures for the easy stuff and Anomaly/ML for the complex stuff.