__________ involves an attempt to define a set of rules or attack patterns that can be used to decide if a given behavior is that of an intruder.
A) Profile based detection
B) Signature detection
C) Threshold detection
D) Anomaly detection

Question

Quizplus · Accepted Answer

Signature detection, also known as rule-based detection, involves a predefined set of rules or attack patterns that are used to identify potential intrusions. This method relies on matching known signatures of attacks to the patterns of behavior in network traffic, host activity, or system logs. Therefore, it helps to identify known attacks but may not detect new or modified threats that do not match the established signatures. The other options listed are different techniques for intrusion detection, but they do not involve a predefined set of rules like signature detection.

__________ Involves an Attempt to Define a Set of Rules