false positives. The actual attack can then progress concealed within these false positives.

It can also render the system administrator to turn off the IDS components that produce

the false positives, thus letting the attack progress undetected once the sensor is turned

off. Squealing can also be used to alter statistical benchmarks used by anomaly detection

sensors especially during their training periods. Once the benchmarks are updated, the

actual attack can proceed without being detected as the excitation will be well below the

new thresholds.

 2.8 Trends in Intrusion Detection

 The trend in intrusion detection is to distribute and use more specialized sensors.

The result of this effort is hundreds of system components. All of these components

should have an infrastructure to support them. A distributed Intrusion Detection System

to support this many components is highly desirable.

 There is a move to incorporate intrusion detection sensors into everyday

computing environments. Intrusion detection should no longer be an optional component;

it should be part of the operating system design. This will make tampering with the

Intrusion detection system itself more difficult and make the process more efficient.

 Data mining techniques are now being employed into intrusion detection sensors

to catch previously unknown intrusions and to dynamically update sensor rules. Data

warehousing techniques are also being used to effectively manage the huge amount of

data being generated by the IDS.

 For high performance networks, there is an effort to move intrusion detection into

the network hardware. Cisco's Catalyst 6000 is an example of a switch with intrusion

detection built into the switch itself.