looking for IDS's based on network behavior analysis

Check this new software-only NBA system:

I'd recommend you to do a comparative study for running or not running such an IDS at all. For most companies the practical trial has shown that running such an IDS requires a lot of effort, at least two full-time hired professionals and achieving very little security.

Better wait 10 years until the log analysis have improved to a sufficient level of intelligence on automation.

Consider an IPS (Intrusion Prevention System). Some are IDSs with some expanded functionality and others are ground up built to go in-line. Check latency and throughput along with attack coverage and timeliness.

IDSs are OK if as noted below you have lots of time OR have a specific need for forensics analysis (but at the cost of actually stopping anything).

Some IPSs have integrations with NBAD vendors such as Mazu or Lancope. NBAD is good for the "low and slow" attacks and IPS for standard network security.

Good Luck.

-BG

Sebastian G. wrote:

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

That's not entirely correct with modern NBADs. Yes, the old ones suffered this problem but many modern ones have a "resolution" as high as 1 minute. I'd not call it too slow. As such, they're valuable additions to IDS/IPS defenses (that have their shares of problems too).

Best,

S.