It compares a snapshot of the file system, boot records, or memory with a known trusted baseline.

It compares a snapshot of the file system, boot records, or memory with a known trusted baseline.

• A. Heuristic-Based Detection
• B. Anomaly-Based Detection
• C. Integrity-Based Detection
• D. Signature-Based Detection

Answer: (C)

Integrity-based detection centers on ensuring system components haven’t changed from a trusted baseline. You start by capturing a snapshot of critical parts—files, boot records, and other key elements—using hashes and metadata, then store that baseline securely. Later, you re-scan and compare the current state to the baseline; any mismatch in a file, boot sector, or memory region signals tampering or unauthorized modifications. This approach is powerful because it detects changes even if the malware is new or lacks a known signature, by focusing on deviations from what the system was known to be. Other methods focus on different signals: heuristic and anomaly-based approaches look at suspicious behavior or deviations from normal usage patterns, while signature-based detection relies on matching known malware patterns. None of those inherently compare the system to a trusted, pre-established snapshot of its own state like integrity-based detection does.

Integrity-based detection centers on ensuring system components haven’t changed from a trusted baseline. You start by capturing a snapshot of critical parts—files, boot records, and other key elements—using hashes and metadata, then store that baseline securely. Later, you re-scan and compare the current state to the baseline; any mismatch in a file, boot sector, or memory region signals tampering or unauthorized modifications. This approach is powerful because it detects changes even if the malware is new or lacks a known signature, by focusing on deviations from what the system was known to be.

Other methods focus on different signals: heuristic and anomaly-based approaches look at suspicious behavior or deviations from normal usage patterns, while signature-based detection relies on matching known malware patterns. None of those inherently compare the system to a trusted, pre-established snapshot of its own state like integrity-based detection does.