Signature-Based Detection: Signature based IDS monitors packets in the Network and compares with pre-configured and pre-determined attack patterns known as signatures. Statistical anomaly-based detection: A statistical anomaly-based IDS determines the normal network activity —like what sort of bandwidth is generally used, what protocols are used, what ports and devices generally connect to each other— and alerts the administrator or user when traffic is detected which is anomalous (not normal). Stateful Protocol Analysis Detection: This method identifies deviations of protocol states by comparing observed events with “predetermined profiles of generally accepted definitions of benign activity.”[3]