Signature-based approaches attempt to define normal, or expected,behavior, whereas anomaly approaches attempt to define proper behavior.

Question

Quizplus · Accepted Answer

Signature-based approaches attempt to identify known patterns or signatures of malicious behavior, while anomaly detection looks for deviations from normal or expected behavior. Therefore, signature-based approaches define normal behavior, while anomaly approaches define abnormal behavior.

Signature-Based Approaches Attempt to Define Normal, or Expected,behavior, Whereas Anomaly