Network Intrusion Detection and Classification
Network Intrusion Detection and Classification
9.1 Course Context and Second-Half Roadmap
Where are we now? The course has crossed the halfway mark. The first half built your foundation — AI/ML basics for those new to the field, cybersecurity fundamentals for those new to security, and supervised learning approaches for anomaly detection. The second half puts that foundation to work on real network security problems.
The course enters its second half, shifting from foundational concepts covered before the midterm into applied network security topics. Before the midterm, the course covered:
- AI/ML basics for students less familiar with that area
- Cybersecurity fundamentals for those new to security
- Supervised learning approaches for anomaly detection at a high level — when to use which algorithm and why
The second half is structured around these topics:
- Lectures 9–10: Network intrusion detection and classification (the current topic)
- Lecture 11: Domain Generation Algorithms (DGAs) — students expressed interest in learning how to generate and test DGAs early in the course
- Later lectures: Network traffic profiling, adversarial machine learning, and a review session
- Lectures 13–14: Countermeasures — expected to be a deeper, more hands-on exploration
The second half is generally lighter than the first half, which was heavy with jargon and foundational theory. By now students should have settled on ground basics from preparing for the midterm.
Recap: The first half gave you the tools; the second half teaches you how to apply them to real network security scenarios. Lectures 9–10 focus on network intrusion detection and classification — the foundation of modern network defense.
9.1.1 Assignment Details
Assignment 1 will open on 12 July and remain available for 14 days. Key details:
- Format: Individual assignment (not group work)
- Content: Part research and part programming/notebook
- Prerequisite: Basic Python skills are expected
- Timing: Students get a breather after the exam, then can finish the assignment before end-of-semester workload piles up
Exam note: The assignment will be announced on the course page. Students who are not from a programming background are expected to use available tools — as the instructor noted, "with all these vibe coding tools, language doesn't matter beyond English."
9.2 Why AI/ML Is Needed for Network Intrusion Detection
The core problem: Network security is an arms race — attackers modify techniques constantly. Traditional defenses that rely on fixed rules cannot keep up. Machine learning provides the adaptive capability needed to detect threats that have never been seen before.
Network security is an arms race — attackers modify techniques constantly. The intrusion kill chain and the Pyramid of Pain (covered earlier in the course) illustrate why static defenses fail. ML enables adaptive defense that can learn from attack behavior, not just signatures. This is the key takeaway for the entire lecture: by the end, students should be convinced that ML-based approaches are necessary.
9.2.1 The Adaptive Defense Argument
Why static defenses fail: Traditional intrusion detection relies on signatures — predefined patterns of known attacks. The problem is that attackers can easily modify their code, change byte sequences, or use encryption to evade signature-based detection. Once a new attack variant appears, defenders must manually create a new signature. This creates a perpetual lag between attack innovation and defense adaptation.
The problem is approached at a practical, production-deployment level rather than purely academic. The focus is on how things work in real systems, how features are selected, what ensemble methods apply, and how to get models into production.
Every generation of technology — TCP/IP, web applications, cloud, AI — offers enormous opportunity to solve tough problems. Each generation also creates new attack surfaces and new defense challenges. Network security is a never-ending arms race, and ML provides the adaptive capability needed to keep pace.
Scope: This lecture focuses on network-level intrusion detection — analyzing packets and traffic flows. Application-layer attacks (like SQL injection or cross-site scripting) require different detection methods and are covered in later topics.
Recap: Static signature-based defenses are necessary but not sufficient. ML-based approaches can learn from attack behavior and detect novel threats, making them essential for modern network security. The rest of this lecture explores three fundamental detection approaches and how ML builds on them.
9.3 Network Traffic Analysis — The Foundation
Why this matters: Network traffic analysis is the very foundation for ML-based intrusion detection. Without understanding what traffic analysis is, it is very difficult to appreciate or design ML models for it. Think of it as learning to read before you can write — traffic analysis is the "reading" skill that makes everything else possible.
Network traffic analysis is the very foundation for ML-based intrusion detection. Without understanding what traffic analysis is, it is very difficult to appreciate or design ML models for it.
9.3.1 Everyday Network Analogies
The most familiar non-technical network is road traffic. Roads have junctions, traffic lights, diversions, and routing — people moving from one place to another. Traffic cops regulate flow and catch mischief. The instructor asks students to keep this mental model throughout the next two classes: imagine you are that traffic cop, trying to identify suspicious activity on an IT network.
Analogy — The Traffic Cop: A traffic cop at a busy intersection watches for patterns: a car running a red light, a vehicle driving erratically, or someone making illegal U-turns. They don't need to know what's inside the car — they observe behavior. Network traffic analysis works the same way: you observe patterns in how data moves, not necessarily what's inside the packets.
A second analogy is an airport network — passengers move through checks, security screening, boarding, and arrival. Security personnel look for forbidden materials, people on watchlists, or suspicious behavior patterns.
Analogy — Airport Security: Airport security has multiple layers: check-in counters verify identity, metal detectors scan for weapons, X-ray machines examine luggage contents, and behavioral profiling watches for nervous passengers. Each layer catches different types of threats. Network defense works similarly — multiple detection methods at different layers catch different attack types.
The core principle across all networks — road, airport, or IT — is the same: stop something nefarious as early as possible. The sooner, the better.
Where the analogy breaks: Unlike road traffic or airport passengers, network traffic moves at the speed of light, involves billions of simultaneous connections, and attackers can hide inside encrypted tunnels. A traffic cop can physically stop a car; a network defender must work with statistical patterns and automated systems.
9.3.2 What Can Go Wrong in a Network?
Two primary use cases frame the discussion:
- Distributed Denial of Service (DDoS): Someone bombards the network with hundreds of GBs of packets, overwhelming it so legitimate users cannot connect. The network goes down — this is an attack on availability, one of the three pillars of the CIA triad (Confidentiality, Integrity, Availability) covered in the first class. Even if a network fault causes downtime, availability is compromised; if an attacker deliberately causes it, it is a cyber attack.
- Data Exfiltration: Someone steals data — uploading intellectual property, code, bank details, designs, or other sensitive information. This is an attack on confidentiality. Normal users download more than they upload (watching movies, reading news, sending email). A sudden reversal of upload/download ratios can indicate data theft.
The CIA Triad Connection: These two attack types map directly to the CIA triad:
- DDoS attacks Availability — the network becomes unusable
- Data Exfiltration attacks Confidentiality — sensitive data is stolen
- Integrity attacks (like data tampering) are harder to detect at the network level and typically require application-layer analysis
These two cases are the primary focus for network intrusion detection at the packet level. More advanced attacks like privilege escalation require application-layer logs and are considered "higher order" — at the network level, you may not even know what is inside an encrypted packet.
Real-world: The instructor notes that these same principles apply beyond IT — on roads, police stop certain vehicles during certain hours; at airports, forbidden materials are confiscated; in social networks, trust boundaries are breached when secrets leak through friend-of-friend chains. "Your network is your net worth" — the value in a network is what motivates attackers to penetrate it.
Recap: Network traffic analysis is the foundation of intrusion detection. The two primary threats are DDoS (attacking availability) and data exfiltration (attacking confidentiality). The next section explores three fundamental approaches to detecting these threats.
9.4 Three Approaches to Network Traffic Detection
The big picture: There are three high-level approaches to identifying malicious activity in a network. These are not machine learning approaches — they are fundamental detection strategies. Understanding these three approaches is essential before you can appreciate how ML builds on top of them.
There are three high-level approaches to identifying malicious activity in a network. These are not machine learning approaches — they are fundamental detection strategies.
9.4.1 Deep Packet Inspection (DPI)
Analogy — Frisking: Think of deep packet inspection as frisking. When you enter a high-security zone, security inspects your vehicle — they put a mirror under the bonnet, ask you to open the trunk, and physically examine what is inside. At airports, you take everything out, put items in a tray, sometimes remove belt, shoes, and coat. DPI does the same thing to network packets — it opens them up and examines every detail inside.
In IT networks, DPI means opening the packet and examining the payload content. If someone sends an email, DPI means a system (automated or human) opens that email, including attachments, and examines the content. This is the most thorough form of inspection.
What are you looking for? Just as airport security has a list of forbidden materials, DPI uses signatures — patterns that indicate malicious content. These signatures are the network equivalent of a "most wanted" list or a forbidden materials catalogue.
Signature-based detection: DPI compares packet contents against a database of known attack signatures. A signature is a pattern — a sequence of bytes, a string, or a regular expression — that uniquely identifies a known attack. If the packet content matches a signature, the system raises an alert. This is the same principle used by antivirus software to detect known malware.
Real-world tools: The most popular signature-based IDS is Snort, an open-source tool created by Marty Roesch around 1999 in Maryland, US. Snort was originally from a company called Sourcefire, which was later acquired by Cisco. The Cisco Talos research team maintains the signature rules. An alternative is Suricata. Students interested in hands-on experience can download and set up either tool in a lab.
9.4.1.1 Snort Signature Example
Worked Example — Snort Rule for mountd Access:
A sample Snort rule:
alert tcp any any -> 192.168.x.x any (content:"|00 01 86 85|"; msg:"mountd access";)Let's break this down step by step:
alert— The action to take when a match is found. Other options includedrop(block the traffic) andallow(let it through but log it).tcp— The protocol to monitor. This rule watches TCP traffic specifically.any any— The source: any IP address, any port. The rule doesn't care where the traffic comes from.->— The direction of traffic flow. The arrow points from source to destination.192.168.x.x any— The destination: a specific IP address range, any port. The rule watches for traffic going to this particular network.content:"|00 01 86 85|"— The signature pattern. The rule looks for this specific byte sequence in the packet payload. The byte sequence00 01 86 85corresponds to a mount command — someone is trying to mount a remote drive.msg:"mountd access"— The alert message. When a match is found, the system logs "mountd access" — indicating someone is attempting to access a remote file system.
What this means in practice: The rule watches all TCP traffic going to the specified IP address. If any packet contains the byte sequence that corresponds to a mount command, the system raises an alert. This is a classic example of signature-based detection — the system knows what a mount command looks like (the byte pattern) and watches for it.
Snort can be configured in different modes:
- Alert mode: Log suspicious traffic but do not block it (many administrators start here)
- Drop mode: Block the suspicious traffic
- Allow mode: Let it through but log it
The Cisco Talos team researches network traffic patterns and continuously updates the signature rules, similar to how antivirus vendors update virus definitions.
Advantages of DPI:
- High accuracy for known signatures — if a signature exists, DPI will catch it
- Can detect specific commands, payloads, and content patterns
- Well-understood technology with decades of operational experience
Disadvantages of DPI:
- High computational cost — inspecting every packet slows traffic significantly
- Cannot detect unknown attacks (no signature = no detection)
- Critically: fails when traffic is encrypted
- Requires constant signature updates as new attacks emerge
9.4.1.2 The Encryption Problem
The fundamental shift: The widespread adoption of encrypted traffic has made signature-based IDS like Snort increasingly obsolete. Today, almost all web traffic uses HTTPS (HTTP over SSL/TLS), providing end-to-end encryption. Even Google will not return HTTP sites in search results. SSH sessions are encrypted. Email payloads between major providers are encrypted.
If the traffic is encrypted, DPI cannot see the payload — just as an airport scanner cannot see inside a fully locked, opaque container. The scanner either has to open it (which defeats the purpose of encryption) or deny it.
Real-world: The instructor worked at Cisco about 10 years ago and witnessed this problem emerge — encrypted traffic rendering traditional intrusion detection systems ineffective. After years of research, encrypted traffic analysis techniques were developed and deployed. This is now a cutting-edge area of active research.
Exam note: This encryption-versus-DPI tension is a key concept. Traditional signature-based detection has its place but is increasingly not enough in a world of pervasive encryption. This is why flow-based and protocol analysis have become critical.
Q: Is Snort an algorithm-based technique, not ML? A: Correct. Snort is not ML-based. It is a deterministic software that matches signatures against traffic — essentially regular expression matching, string matching, and substring matching at its core. It has advantages and challenges, which are discussed in detail. The key distinction is that Snort uses predefined rules (signatures) rather than learning from data.
9.4.2 Flow-Based Analysis
The key insight: Flow-based analysis does not open the packet at all. Instead, it examines metadata and statistical information — who is talking to whom, how often, how much data is transferred, how long sessions last, and other behavioral patterns. This is like knowing who called whom, when, and for how long — without knowing what was said.
Flow-based analysis does not open the packet at all. Instead, it examines metadata and statistical information — who is talking to whom, how often, how much data is transferred, how long sessions last, and other behavioral patterns.
9.4.2.1 The Call Record Analogy
Analogy — Phone Call Records: Your phone call log shows: who called whom, at what time, and how long the call lasted. It does not show what was talked about (unless the call is recorded). From just this metadata, you can build powerful heuristics:
- A call lasting 2–3 seconds is likely a spam call (the person hung up immediately)
- A call lasting 15 minutes to a friend is likely a real conversation
- A pattern of very short calls to many different numbers indicates a spam bot
This is exactly how flow-based analysis works on networks — using only metadata, not payload content.
9.4.2.2 The Airport Smuggling Analogy
Worked Example — Airport Smuggling Detection:
A real case illustrates flow-based detection: a couple was caught smuggling children through airports. Individually, nothing was suspicious — valid passports, no forbidden materials, a family traveling. But the flow pattern gave them away:
- Trip 1: Couple travels with Child A to a foreign country. Looks normal — a family vacation.
- Trip 2: Two days later, couple returns. Child A is not with them. Suspicious, but could be explained (child stayed with relatives).
- Trip 3: Couple travels again, this time with Child B (a different child). Now the pattern is becoming clear.
- Trip 4: Couple returns without Child B. The pattern is unmistakable.
The pattern: Multiple trips with a child, but the child was different each time. Trips were back-to-back. On the return trip, there was no child.
The key insight: No single trip raised flags, but the statistical pattern across multiple trips revealed the crime. This is flow-based analysis — detecting anomalies through behavioral patterns in metadata.
Sense-check: If you only looked at each trip in isolation, you would see nothing suspicious. It's only when you analyze the flow across multiple trips that the pattern emerges. This is why flow-based analysis is so powerful — it catches what individual packet inspection misses.
9.4.2.3 Network Flow Features
In network traffic, flow-based analysis extracts features such as:
- Packet count: How many packets went in each direction
- Data transfer sizes: Upload vs. download volume
- Session duration: How long the connection lasted
- Time-to-live (TTL): How long packets live in the network
- Outbound connection persistence: Are connections staying open unusually long?
- Beaconing intervals: Regular periodic connections (common in command-and-control traffic)
- Upload/download ratios: Normal users download more; data exfiltration reverses this
Feature Engineering: A student correctly identified that flow-based analysis is essentially feature engineering from packet metadata. The features extracted (packet counts, TTL, session duration) become inputs to ML models. What features you extract and what models you build on top of them is the subject of further discussion. This is where the ML comes in — flow features are the raw material that machine learning algorithms use to classify traffic as normal or malicious.
Advantages of flow-based analysis:
- Works even with encrypted traffic (metadata is not encrypted)
- Lower computational cost than DPI (no need to inspect every byte)
- Can detect novel attacks through behavioral anomalies
- Scales well to high-speed networks
Disadvantages:
- Cannot see payload content — may miss attacks hidden inside encrypted streams
- Requires good feature engineering to be effective
- Higher false positive rate than signature-based detection for known attacks
9.4.2.4 Reverse Shell Detection Example
Worked Example — Reverse Shell Detection (DPI vs Flow-Based):
Consider an attacker who has established a reverse shell — gaining outbound access from a compromised server.
DPI approach:
- Look for shell-related signatures in packet payloads
- Watch for strings like
sh,bash, commands likerm -rf, or themountdexample from the Snort rule - If the traffic is encrypted, DPI sees nothing
Flow-based approach:
- Without opening packets, flow analysis can detect anomalies like:
- Persistent outbound connections: A server that normally only receives incoming requests is now maintaining long-lived outbound connections
- Unusual upload/download ratios: A web server that normally sends more data than it receives is now uploading large amounts of data
- Beaconing intervals: Regular periodic connections (e.g., every 30 seconds) consistent with command-and-control (C2) traffic
Connection to the kill chain: This corresponds to the installation and command-and-control stages of the intrusion kill chain. The attacker has already gained access (installation) and is now maintaining communication with the compromised system (C2).
Key takeaway: DPI catches the attack if you have the right signature and the traffic is unencrypted. Flow-based analysis catches the attack by noticing behavioral anomalies — even if you've never seen this specific attack before.
Q: In flow-based analysis, are we doing feature engineering to extract certain features? A: Yes, exactly. The raw data is your packet captures, and the features you extract could be packet counts, time-to-live, session duration, and so on. The ML models you build depend on the features you engineer from the flow data. The quality of your features directly determines how well your ML model can detect attacks.
9.4.3 Protocol Analysis
The third approach: Protocol analysis goes deeper than flow-based analysis but still does not examine the payload content. Instead, it analyzes the state machine of the communication protocol. It asks: "Is this conversation following the rules?" rather than "What's inside the conversation?"
Protocol analysis goes deeper than flow-based analysis but still does not examine the payload content. Instead, it analyzes the state machine of the communication protocol.
9.4.3.1 What Is a State Machine?
Any protocol — TCP/IP, a simple whistle signal, or a complex application protocol — has a defined sequence of states and transitions. The instructor gives a childhood analogy: when calling friends to come play, two whistles might mean "come down," one whistle means "come to the window." This agreed-upon signal sequence is a protocol — both parties know what to expect.
Analogy — Whistle Protocol: Imagine you and your friend have a code: two whistles means "come down and play," one whistle means "come to the window." If you hear three whistles, something is wrong — that's not part of the protocol. Protocol analysis works the same way: it watches for states and transitions that don't match the expected sequence.
In TCP/IP, the state machine defines the sequence: SYN → SYN-ACK → ACK → data transfer → FIN → session close. Both client and server follow this agreed sequence.
9.4.3.2 TCP State Machine
TCP State Machine: The TCP state transition diagram shows all possible states a connection can be in:
- LISTEN: Server waiting for connections
- SYN_SENT: Client sent a connection request
- SYN_RECEIVED: Server received the request and sent acknowledgment
- ESTABLISHED: Connection is open, data can flow
- FIN_WAIT / CLOSE_WAIT / LAST_ACK: Connection teardown sequence
- CLOSED: Connection terminated
By observing which state the protocol is in at any point, analysts can determine whether behavior is normal or malicious — without ever looking at the data payload.
9.4.3.3 SYN Flood Attack — A Protocol-Level Attack
Worked Example — SYN Flood Attack:
The SYN flood attack exploits the TCP state machine. The attacker's goal is to bring down the server by exhausting its resources, not to perform any meaningful transaction.
Step-by-step walkthrough:
- Attacker sends SYN packets: The attacker sends many SYN (synchronous) packets to the server. Each SYN packet says "I want to connect."
- Server responds with SYN-ACK: The server, following the TCP protocol, sends SYN-ACK (acknowledge) packets back. For each pending connection, the server allocates resources (memory, table entries) to track the half-open connection.
- Attacker never sends ACK: The attacker never sends the final ACK to complete the three-way handshake. The server is left waiting.
- Server keeps resources allocated: The server keeps resources allocated for these half-open connections, waiting for the ACK that will never come.
- Server exhausts resources: Eventually, the server runs out of memory/resources and cannot accept new connections — legitimate users are locked out.
Why protocol analysis catches it: If the system maintains the state machine bookkeeping — tracking that "I sent SYN, I sent SYN-ACK, but I never received ACK back" — it can detect this pattern. The attack succeeds when systems do not properly track protocol states and keep allocating resources to incomplete connections.
Sense-check: This is a classic denial-of-service attack. The attacker isn't trying to steal data or gain access — they're simply overwhelming the server's ability to handle connections. The attack exploits the fact that TCP was designed for a trusted environment where both parties follow the rules.
Real-world: This is a real, well-known attack. Scripts to perform SYN flood attacks are readily available, but using them on unauthorized systems is illegal.
The instructor's analogy: If 100 people ask you questions with no intention of listening to your answers — just to create trouble — you will eventually give up. That is exactly what the server experiences in a SYN flood. The server is trying to be helpful (following the protocol), but the attackers are abusing that helpfulness.
Recap: Three fundamental detection approaches exist: Deep Packet Inspection (examines payload content), Flow-Based Analysis (examines metadata and statistical patterns), and Protocol Analysis (examines protocol state machines). Each has strengths and weaknesses. The next section compares them directly.
9.5 Comparison of the Three Approaches
Why compare? Each detection approach has strengths and weaknesses. Understanding when to use which approach — and how they complement each other — is essential for designing effective network defense systems.
9.5.1 Side-by-Side Comparison
| Approach | What It Examines | Encryption Impact | Can Detect Novel Attacks | Computational Cost |
|---|---|---|---|---|
| Deep Packet Inspection | Full payload content | Fails (can't see inside encrypted packets) | No (needs known signatures) | High |
| Flow-Based Analysis | Metadata and statistical patterns | Works (metadata is unencrypted) | Yes (behavioral anomalies) | Medium |
| Protocol Analysis | Protocol state transitions | Works (state info is in headers) | Yes (abnormal state sequences) | Medium |
When to use which:
- DPI is best for unencrypted traffic and deep forensic analysis where you need to see exact payload content. It's the gold standard for known attacks when you have good signatures.
- Flow-Based Analysis is the workhorse for modern networks. It works on encrypted traffic, detects novel attacks through behavioral anomalies, and scales well to high-speed networks.
- Protocol Analysis is complementary to flow-based analysis. It catches attacks that exploit protocol behavior (like SYN floods) that flow-based analysis might miss.
All three techniques support feature engineering — even DPI can extract features from inspected packets. The choice of features and ML models built on top is flexible.
The encryption tipping point: The shift to encrypted traffic has fundamentally changed the landscape. A decade ago, DPI was the primary detection method. Today, with over 90% of web traffic encrypted, flow-based and protocol analysis have become increasingly important because they work regardless of encryption. DPI remains valuable for unencrypted traffic and for deep forensic analysis but is not enough on its own.
Recap: The three approaches are complementary, not competing. Modern network defense systems use all three: DPI for unencrypted traffic and known attacks, flow-based analysis for encrypted traffic and novel attacks, and protocol analysis for protocol-level exploits. The next section provides exam guidance and industry applications.
9.6 Exam Guidance Summary
Exam note: This section summarizes the key exam points from Lecture 9. Review these carefully — they represent the instructor's guidance on what will be tested.
9.6.1 Key Exam Points
- The second half of the course is lighter than the first half
- Assignment 1 opens 12 July, available for 14 days, individual work, part research and part programming
- DGA topic (Lecture 11) is a hands-on topic where students will learn to generate and test DGAs
- Countermeasures deep-dive in Lectures 13–14
- The CIA triad (Confidentiality, Availability) connects directly to network attack types — expect conceptual questions on this
- The three detection approaches (DPI, flow-based, protocol analysis) are fundamental — understand each, their trade-offs, and when each applies
- Encrypted traffic analysis is a cutting-edge topic with real industry relevance
Common exam pitfalls:
- Confusing DPI (which fails on encrypted traffic) with flow-based analysis (which works on encrypted traffic)
- Thinking Snort is ML-based — it's deterministic signature matching
- Not understanding the CIA triad connection to DDoS (availability) and data exfiltration (confidentiality)
- Forgetting that protocol analysis works on headers/state info, not payload content
9.7 Key Industry Applications
Real-world relevance: The detection approaches covered in this lecture are not academic exercises — they are deployed in production networks worldwide. This section connects the theory to industry tools and technologies.
9.7.1 Tools and Technologies
- Snort / Suricata: Open-source signature-based IDS used widely in production networks. Snort was created by Marty Roesch around 1999 and is now maintained by Cisco Talos. Suricata is a modern alternative with multi-threading support.
- Cisco Talos: Research team maintaining Snort signatures — a real-world example of continuous signature updates. Talos researchers analyze network traffic patterns and create new signatures as new attacks emerge.
- Encrypted Traffic Analysis: A research area that emerged from the failure of traditional DPI on encrypted networks — the instructor worked on this at Cisco about 10 years ago, and it has since been deployed in production. This is a cutting-edge area that uses ML to analyze encrypted traffic patterns without decrypting the payload.
- Wireshark: Network packet analyzer used for traffic inspection and analysis. It's the de facto standard for network forensics and debugging.
- C2 (Command and Control) Detection: Flow-based analysis is used to detect beaconing patterns from compromised hosts communicating with attacker infrastructure. Regular periodic connections (e.g., every 30 seconds) are a telltale sign of C2 traffic.
- DDoS Detection: Protocol state analysis helps identify SYN flood and similar resource-exhaustion attacks. Modern DDoS protection systems use a combination of flow-based and protocol analysis to detect and mitigate attacks.
Recap: The tools and technologies discussed here directly implement the detection approaches covered in this lecture. Understanding the theory helps you understand why these tools work the way they do — and where they fall short. The shift to encrypted traffic has driven the industry toward ML-based approaches that analyze metadata and protocol behavior rather than payload content.
AMTCS Lecture 9 notes · Network Intrusion Detection and Classification
Sections Breakdown
Course recap, second-half roadmap, and assignment details.
The arms race argument for adaptive ML-based defense over static signatures.
Traffic analysis fundamentals, road and airport analogies, DDoS and data exfiltration mapped to the CIA triad.
Deep Packet Inspection, Flow-Based Analysis, and Protocol Analysis with worked examples including Snort rules, airport smuggling case, and SYN flood attack.
Side-by-side comparison of DPI, flow-based, and protocol analysis with encryption impact and when to use each.
Key exam points, common pitfalls, and instructor guidance.
Industry tools and technologies: Snort, Suricata, Cisco Talos, Wireshark, encrypted traffic analysis, C2 detection.
Exam Revision Notes
Below is the distilled, exam-ready core. Every entry comes from the full explanation above. Use this section for rapid review; return to the main notes when a point needs more context.
Course Context and Second-Half Roadmap
Must-know: Second half covers network intrusion detection, DGAs, traffic profiling, adversarial ML, and countermeasures. Assignment 1 opens 12 July, 14 days, individual, part research part programming.
Top pitfall: None identified for this section.
Self-check: What are the main topics covered in the second half of the course?
Connects to: Why AI/ML Is Needed for Network Intrusion Detection, Network Traffic Analysis — The Foundation, Three Approaches to Network Traffic Detection
Why AI/ML Is Needed for Network Intrusion Detection
Must-know: ML enables adaptive defense vs static signatures — static defenses fail because attackers can easily evade them. ML learns from behavior, not just patterns.
Top pitfall: Confusing signature-based detection (which only catches known attacks) with anomaly-based detection (which can catch novel attacks).
Self-check: Why are static signature-based defenses insufficient for modern network security?
Connects to: Network Traffic Analysis — The Foundation, Three Approaches to Network Traffic Detection
Network Traffic Analysis — The Foundation
Must-know: Network traffic analysis is the foundation. DDoS attacks availability; data exfiltration attacks confidentiality. Both map to the CIA triad. The principle: stop threats as early as possible.
Top pitfall: Confusing network-level detection (which sees packets) with application-level detection (which sees content). Network-level cannot detect all attack types.
Self-check: What two primary attack types frame network intrusion detection, and which CIA triad pillars do they target?
Connects to: Why AI/ML Is Needed for Network Intrusion Detection, Three Approaches to Network Traffic Detection
Three Approaches to Network Traffic Detection
Must-know: Three detection approaches: DPI (payload inspection, fails on encryption), Flow-Based (metadata analysis, works on encrypted traffic), Protocol Analysis (state machine monitoring). Snort is signature-based, not ML. SYN flood exploits TCP state machine.
Top pitfall: Thinking DPI works on encrypted traffic — it doesn't. Also confusing Snort (deterministic signature matching) with ML-based approaches.
Self-check: What are the three fundamental network traffic detection approaches, and which one fails on encrypted traffic?
Connects to: Network Traffic Analysis — The Foundation, Comparison of the Three Approaches
Comparison of the Three Approaches
Must-know: Three approaches are complementary, not competing. DPI fails on encrypted traffic; flow-based and protocol analysis work regardless. Modern defense uses all three.
Top pitfall: Thinking one approach is always better than the others. Each has specific strengths and weaknesses.
Self-check: Why has the shift to encrypted traffic made flow-based and protocol analysis more important?
Connects to: Three Approaches to Network Traffic Detection, Exam Guidance Summary
Exam Guidance Summary
Must-know: CIA triad connects to DDoS (availability) and data exfiltration (confidentiality). Three detection approaches are fundamental. Encrypted traffic analysis is cutting-edge.
Top pitfall: Confusing DPI with flow-based analysis; thinking Snort is ML-based.
Self-check: Which CIA triad pillar does DDoS attack? Which does data exfiltration attack?
Connects to: Three Approaches to Network Traffic Detection, Comparison of the Three Approaches
Key Industry Applications
Must-know: Snort/Suricata are signature-based IDS. Wireshark is for packet analysis. Encrypted traffic analysis uses ML. C2 detection uses flow-based analysis. DDoS detection uses protocol analysis.
Top pitfall: None identified for this section.
Self-check: Name two open-source signature-based IDS tools and one tool for network packet analysis.
Connects to: Three Approaches to Network Traffic Detection, Comparison of the Three Approaches
Was this lecture useful?
BitsNotes AI Assistant
Subject Notes AssistantConfigure AI Chat
Choose how to access the chatbotSigned in as
Powered by BitsNotes — 20 messages per day. No API key needed. Want unlimited access? Use "Bring Your Own Key" mode.
Sign in to use AI Chat
Get 20 free AI messages per day to ask questions about your lecture notes. Sign in with Google or GitHub — it takes 5 seconds.
Sign In to BitsNotesSwitch to "Bring Your Own Key" tab above for unlimited access with any OpenAI-compatible provider.