Which detection approach uses a database of anomalies and flags deviations from normal traffic, contrasting with signature detection?

Which detection approach uses a database of anomalies and flags deviations from normal traffic, contrasting with signature detection?

• A. Network Intrusions
• B. Signature Recognition
• C. Protocol Anomaly Detection
• D. Anomaly Detection

Answer: (D)

Anomaly detection hinges on a model of normal network behavior and flags anything that deviates from that baseline. It builds a profile of typical traffic and uses thresholds or learned patterns to score events; when something looks anomalous, it’s alerted as suspicious. This approach excels at catching unknown or novel threats because they don’t match any preexisting patterns. Signature-based detection, by contrast, relies on a database of known attack patterns and flags only those matches. Protocol-focused checks can be part of anomaly detection, but the general idea described—flagging deviations from normal traffic—fits anomaly detection best.

Anomaly detection hinges on a model of normal network behavior and flags anything that deviates from that baseline. It builds a profile of typical traffic and uses thresholds or learned patterns to score events; when something looks anomalous, it’s alerted as suspicious. This approach excels at catching unknown or novel threats because they don’t match any preexisting patterns. Signature-based detection, by contrast, relies on a database of known attack patterns and flags only those matches. Protocol-focused checks can be part of anomaly detection, but the general idea described—flagging deviations from normal traffic—fits anomaly detection best.