I have difficulties in understanding the difference between Knowledge-based IDS and behavior-based IDS.
This link says that a knowledge-based IDS uses a database of specific attacks and system vulnerabilities, which is blacklist method, I think. But what about a IDS that uses whitelist? Is this IDS still a Knowledge-based IDS? (or a behavior-based IDS?)
Here is an example of a simple IDS, can someone tell me is this IDS a Knowledge-based IDS or a behavior-based IDS?
Example:
A simple IDS has a whitelist of all allowed personnel. And the whitelist looks like [alice, bob]
.
When alice or bob comes, no alarm is sound. But when jack comes, the intrusion alarm is triggered.
(you can also think alice, bob and jack as network packet IDs)
So, knowledge-based? behavior-based?