How is NetSenX different from a signature-based IDS?
A signature-based IDS matches traffic against known attack patterns; NetSenX scores how each host behaves, so a new malware variant without a signature still leaves a trail. Every alert lists, in plain language, the network features that drove its score (SHAP values). NetSenX works alongside your IDS, EDREDR: endpoint detection and response. Security software installed on each computer that watches what happens on that machine. and SIEMSIEM: security information and event management. A system that collects logs from many systems and looks for patterns across them. — it does not replace them.
This answer also appears, with more context, here: NetSenX home page
Read next
Related questions
Terms used here
- EDR (endpoint detection and response)
- Security software installed on each computer that watches what happens on that machine.
- SIEM (security information and event management)
- A system that collects logs from many systems and looks for patterns across them.