Editing Intrusion detection system (section)

====Signature-based====
Signature-based IDS is the detection of attacks by looking for specific patterns, such as byte sequences in network traffic, or known malicious instruction sequences used by malware.<ref>{{cite web |url=http://www.iup.edu/WorkArea/DownloadAsset.aspx?id=81109 |website=www.iup.edu |format=[[Microsoft PowerPoint|PPT]] |author=Brandon Lokesak |date=December 4, 2008 |title=A Comparison Between Signature Based and Anomaly Based Intrusion Detection Systems}}</ref> This terminology originates from [[anti-virus software]], which refers to these detected patterns as signatures. Although signature-based IDS can easily detect known attacks, it is difficult to detect new attacks, for which no pattern is available.<ref>{{Cite book|url=https://books.google.com/books?id=dHys9OXMFMIC&q=signature+IDS+disadvantage&pg=PA86|title=Network Security: Current Status and Future Directions|last1=Douligeris|first1=Christos|last2=Serpanos|first2=Dimitrios N.|date=2007-02-09|publisher=John Wiley & Sons|isbn=9780470099735|language=en}}</ref>
{{expand section|date=March 2019}}

In signature-based IDS, the signatures are released by a vendor for all its products. On-time updating of the IDS with the signature is a key aspect.