Conclusion

It is hard to tell which IDS method is best. The choice depends on what you are trying to achieve as network administrator. The Cisco philosophy to date has been to combine the use of pattern matching, stateful-pattern matching, protocol decodes, and heuristic-based signatures.

Cisco and other vendors continue to research and monitor developments in the IDS arena and incorporate new techniques as they become efficient, practical, and commercially feasible.