A proper IDS rule looks for patterns deviating from this. For example, a connection starting with an ACK without a prior SYN is often indicative of a firewall evasion attempt or a TCP scan (like an ACK scan) attempting to map firewall rulesets.
Example Snort-like rule (conceptual): alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:"Possible SQLi attempt"; flow:established,to_server; content:"SELECT"; http_uri; pcre:"/(%27)|(')|(--)|(%23)|(#)/i"; sid:1000001; rev:1;) sec503 intrusion detection indepth pdf 258
SANS Institute course SEC503: Intrusion Detection In-Depth, page 258, covers IDS definitions and architecture, often following sections on host baselining. The curriculum in this area addresses the transition from signature-based detection to behavioral monitoring and the analysis of normal versus abnormal traffic. For more details, visit the SANS course description SANS Institute SEC503: Network Monitoring and Threat Detection In-Depth A proper IDS rule looks for patterns deviating from this
. The course takes a "bottom-up" approach, starting with the fundamentals of TCP/IP and moving into advanced protocol analysis. The curriculum in this area addresses the transition