This white paper aims at briefly describing the technologies currently used in

filter design in Network-based Intrusion Detection System (NIDS). We will consider

the advantages and drawbacks of using signature filters versus anomaly filters,

and more particularly protocol anomaly filters.

This is the result of research work done at Defcom Sweden, Stockholm.