The document discusses two types of detection methods: rule-based detection and statistical anomaly detection. Rule-based detection uses predefined rules to identify intruder behavior, while statistical anomaly detection analyzes legitimate user behavior over time and applies statistical tests to identify deviations. Both approaches include sub-methods such as anomaly detection, penetration identification, threshold detection, and profile-based detection.

1. 1.Rule based detection 2.Statical anomaly detection
1.Rule based detection :
a set of rules are used to decide the behaviour of an intruder
in this detection we have anomaly detection and penitration identification .in anomaly detection
rules are developed to detect deviation from previous usage patterns. in penitration identification
an expert system approach that searches for suspecious behaviour
2.Statistical anomaly datection :
the collection of data relating to the behaviour of legitimate users over a period of time. then
statistical tests are applied to observed behaviour to determine with a high level of confidence
whethear that behaviour is not legitimate user behaviour
in this detection we have threshold detection and profile based detection .in threshold detection it
approaches to defining thresholds,independent of user,for the frequency of occurence of various
events and in profile based a profile of the activity of each user is developed and used to detect
changes in the behaviour of individual accounts.
Solution
1.Rule based detection 2.Statical anomaly detection
1.Rule based detection :
a set of rules are used to decide the behaviour of an intruder
in this detection we have anomaly detection and penitration identification .in anomaly detection
rules are developed to detect deviation from previous usage patterns. in penitration identification
an expert system approach that searches for suspecious behaviour
2.Statistical anomaly datection :
the collection of data relating to the behaviour of legitimate users over a period of time. then
statistical tests are applied to observed behaviour to determine with a high level of confidence
whethear that behaviour is not legitimate user behaviour
in this detection we have threshold detection and profile based detection .in threshold detection it
approaches to defining thresholds,independent of user,for the frequency of occurence of various
events and in profile based a profile of the activity of each user is developed and used to detect
changes in the behaviour of individual accounts.