# Intruder detection

> Mediated Wiki article. Canonical URL: https://mediated.wiki/source/Intruder_detection
> Markdown URL: https://mediated.wiki/source/Intruder_detection.md
> Source: https://en.wikipedia.org/wiki/Intruder_detection
> Source revision: 1329106790
> License: Creative Commons Attribution-ShareAlike 4.0 International (https://creativecommons.org/licenses/by-sa/4.0/)

For network protection devices or software, see [Intrusion detection system](/source/Intrusion_detection_system).

In [information security](/source/Information_security), **intruder detection** is the process of detecting intruders behind attacks as **unique persons**. This technique tries to identify the person behind an attack by analyzing their computational behaviour.

## History

Some other earlier works reference the concept of Intruder Authentication, Intruder Verification, or Intruder Classification, but the [Si6](/source/Si6) project was one of the first projects to deal with the full scope of the concept.

## Theory

Intruder Detection Systems try to detect who is attacking a system by analyzing his or her computational behaviour or [biometric](/source/Biometric) behaviour.

### Some of the parameters used to identify a intruder

- [Keystroke Dynamics](/source/Keystroke_Dynamics) (aka keystroke patterns, typing pattern, typing behaviour)
- Patterns using an interactive command interpreter: - Commands used - Commands sequence - Accessed directories - Character deletion
- Patterns on the network usage: - IP address used - ISP - Country - City - Ports used - TTL analysis - Operating system used to attack - Protocols used - Connection times patterns

### Keystroke dynamics

[Keystroke dynamics](/source/Keystroke_dynamics) is paramount in Intruder Detection techniques because it is the only parameter that has been classified as a real 'behavioural biometric pattern'.

Keystroke dynamics analyze times between keystrokes issued in a computer keyboard or cellular phone keypad searching for patterns. First techniques used [statistics](/source/Statistics) and [probability](/source/Probability) concepts like 'standard deviations' and 'Mean', later approaches use [data mining](/source/Data_mining), [neural networks](/source/Neural_network), [Support Vector Machine](/source/Support_Vector_Machine), etc.

## Translation confusion

There is a confusion with the Spanish translation of '[Intrusion detection system](/source/Intrusion_detection_system)', also known as IDS. Some people translate it as 'Sistemas de Detección de Intrusiones', but others translate it as 'Sistemas de Detección de Intrusos'[citation needed]. Only the former is correct.

## See also

- [Intrusion-detection system](/source/Intrusion-detection_system)
- [Biometrics](/source/Biometrics)

## External links

- [P0f OS fingerprinting tool](http://lcamtuf.coredump.cx/p0f.shtml)
- [Si6 Paranoid Project](http://www.citefa.gov.ar/SitioSI6_EN/si6.htm) [Archived](https://web.archive.org/web/20051201124728/http://www.citefa.gov.ar/SitioSI6_EN/si6.htm) 2005-12-01 at the Wayback Machine

---
Adapted from the Wikipedia article [Intruder detection](https://en.wikipedia.org/wiki/Intruder_detection) by Wikipedia contributors ([contributor history](https://en.wikipedia.org/wiki/Intruder_detection?action=history)). Available under [Creative Commons Attribution-ShareAlike 4.0 International](https://creativecommons.org/licenses/by-sa/4.0/). Changes may have been made.