Feature Selection And Pattern Categorization. In both anomaly and misuse Intrusion Detection Systems, the optimal set of system parameters to be monitored (anomaly detectors) or design rules (signatures) to be matched (misuse detectors) are often assumed, a priori. Optimal is defined as maximum discrimination between intrusions and normal system behavior while minimizing the set of system parameters monitored.
