IMT4204 - Intrusion Detection in Physical and Virtual Networks


Examination arrangement

Examination arrangement: Assignment and Written examination
Grade: Letters

Evaluation form Weighting Duration Examination aids Grade deviation
Approved report 40/100 A
Home examination 60/100 3 hours

Course content

-IDS/IPS definition and classification
-Basic elements of attacks and their detection
-Misuse detection systems (search algorithms and applications in IDS)
-Anomaly detection systems (machine learning basics: principles, measures, performance evaluation, method combinations, basics of artificial neural networks, clustering (hierarchical and partitional) and supervised learning in IDS)
-Testing IDS and measuring their performances
-Computational complexity-theoretic and information-theoretic IDS models and quality criteria
-Intrusion detection in virtual networks.

Learning outcome

-Possesses advanced knowledge in detection/prevention of intrusions in computer systems and networks, in particular:  application of advanced search algorithms in intrusion detection, unsupervised and supervised learning methods used in these systems, computational complexity-theoretic modeling, information-theoretic modeling of intrusion detection/prevention systems, and intrusion detection in virtual networks.
-Possesses thorough knowledge about theory and scientific methods relevant for intrusion detection.
-Is capable of applying his/her knowledge in design and analysis of intrusion detection/prevention systems.

-Is capable of analyzing existing theories, methods and interpretations in the field of intrusion detection and working independently on solving theoretical and practical problems.
-Can use relevant scientific methods in independent research and development in intrusion detection.
-Is capable of performing critical analysis of various literature sources and applying them in structuring and formulating scientific reasoning in the field of intrusion detection and prevention.
-Is capable of carrying out an independent limited research or development project in intrusion detection under supervision, following the applicable ethical rules.

General competence:
-Is capable of analyzing relevant professional and research ethical problems in the field of intrusion detection.
-Is capable of applying his/her knowledge and skills in new fields, in order to accomplish advanced tasks and projects.
-Can work independently and is familiar with terminology in the field of intrusion detection and prevention.
-Is capable of discussing professional problems in the field of intrusion detection and prevention, both with specialists and with general audience.
-Is capable of contributing to innovation and innovation processes.

Learning methods and activities

-Lab work
-Numerical exercises

Additional information:
-The course will be made accessible for both campus (Gjøvik) and remote students. Every student is free to choose the pedagogic arrangement form that is best fitted for her/his own requirements. The lectures in the course will be given on campus Gjøvik and are open for both categories of students. All the lectures will also be available on Internet through the learning management system.

Compulsory requirements: None.

Further on evaluation

Individual report written by the student at home during the semester - presents a solution to a task given by the course responsible at the beginning of the course. The report counts 40% of the final mark.

The written 3-hours' exam counts 60% of the final mark. Both parts must be passed.

Ordinary re-sit examination in August.

The written exam will be given both on campus Gjøvik and campus Trondheim.

Specific conditions

Admission to a programme of study is required:
Communication Technology (MSTCNNS)
Communication Technology and Digital Security (MTKOM)
Information Security (MIS)
Information Security (MISD)
Information Security (MISEB)
Security and Cloud Computing (MSSECCLO)

Course materials

Compulsory literature:
- Various papers, uploaded in the Blackboard learning management system.

Recommended literature:
Books on intrusion detection and prevention, such as
- 1. Rebecca Gurley Bace, Intrusion Detection, Macmillan, 2000.
- 2. Jack Koziol, Intrusion Detection with SNORT, SAMS, 2003.
- 3. David J. Marchette, Computer Intrusion Detection and Network Monitoring, A Statistical Viewpoint, Springer Verlag, 2001.
- 4. Richard Bejtlich, Extrusion Detection - Security Monitoring for Internal Intrusions, Addison-Wesley, 2005.
- 5. Stephen Northcutt, Judy Novak, Network Intrusion Detection, 3rd edition, New Riders, 2003.

Credit reductions

Course code Reduction From To
IMT4741 5.0 01.09.2017
More on the course



Version: 1
Credits:  7.5 SP
Study level: Second degree level


Term no.: 1
Teaching semester:  AUTUMN 2020

Language of instruction: English

Location: Gjøvik , Trondheim

Subject area(s)
  • Computer and Information Science
Contact information
Course coordinator:

Department with academic responsibility
Department of Information Security and Communication Technology



Examination arrangement: Assignment and Written examination

Term Status code Evaluation form Weighting Examination aids Date Time Digital exam Room *
Autumn ORD Approved report 40/100 A

Release 2020-10-02

Submission 2020-11-30

Release 14:00

Submission 12:00

Room Building Number of candidates
Autumn ORD Home examination (1) 60/100

Release 2020-12-01

Submission 2020-12-01

Release 09:00

Submission 12:00

Room Building Number of candidates
Summer UTS Home examination 60/100 INSPERA
Room Building Number of candidates
  • * The location (room) for a written examination is published 3 days before examination date. If more than one room is listed, you will find your room at Studentweb.
  • 1) Merk at eksamensform er endret som et smittevernstiltak i den pågående koronasituasjonen. Please note that the exam form has changed as a preventive measure in the ongoing corona situation.

For more information regarding registration for examination and examination procedures, see "Innsida - Exams"

More on examinations at NTNU