Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper presents a Systematization of Knowledge (SoK) for Network Intrusion Detection Systems (NIDS), highlighting the disconnection between academic research and real-world deployment. It identifies three key assertions regarding NIDS characteristics, such as the impact of compromised systems and the importance of realistic evaluation environments. The authors provide recommendations for future research, supported by a reproducible case study, aiming to bridge the gap between theory and practice in NIDS research.
NIDS research is often disconnected from real-world deployments because it overlooks fundamental characteristics of these systems, like the impact of compromised components and the need for realistic evaluation environments.
Network Intrusion Detection Systems (NIDS) have been studied for decades. Hundreds of papers have, e.g., proposed ways to enhance, harden or bypass NIDS. However, the findings of prior literature are hardly reflected in real-world operational contexts. Such a disconnection is problematic for research itself: it is unclear what scenario envisioned by prior work can be used as a baseline for future advancements. We argue that a key reason for this disconnection is a fundamental misunderstanding of intrinsic characteristics of NIDS. For instance, the fact that a compromised NIDS cannot be expected to work well; the fact that some evaluations are done without carrying out any experiment in a (even synthetic) "real" network; the fact that security operators triage high-level reports -- and not individual samples flagged by some classifier. In this SoK, which is primarily a reflective piece, we first constructively highlight such quintessential properties (without criticizing _any_ work by different authors) by stating three Assertions. Then, we provide recommendations -- further emphasized through an original and reproducible case study that challenges some established practices. Ultimately, we seek to lay a foundation to reshape research on NIDS.