Which detection approach uses a database of known patterns to identify attacks by matching incoming data against signatures?

Which detection approach uses a database of known patterns to identify attacks by matching incoming data against signatures?

• A. Anomaly Detection
• B. Protocol Anomaly Detection
• C. Signature Recognition
• D. File System Intrusions

Answer: (C)

Signature-based detection relies on a database of known attack patterns and identifies threats by matching incoming data against those patterns. When a match is found in the data—whether network traffic, files, or events—the system raises an alert or blocks the activity. This approach is fast and highly effective for threats that have already been identified and cataloged as signatures, which is why it’s widely used in IDS/IPS and antivirus tools. The trade-off is that it cannot reliably detect new, unknown attacks or novel variants unless the signature database is continuously updated. Other methods aren’t based on matching known patterns: anomaly detection looks for deviations from normal behavior, protocol anomaly detection focuses on irregularities in protocol usage, and “file system intrusions” describes a type of attack rather than a detection technique.

Signature-based detection relies on a database of known attack patterns and identifies threats by matching incoming data against those patterns. When a match is found in the data—whether network traffic, files, or events—the system raises an alert or blocks the activity. This approach is fast and highly effective for threats that have already been identified and cataloged as signatures, which is why it’s widely used in IDS/IPS and antivirus tools. The trade-off is that it cannot reliably detect new, unknown attacks or novel variants unless the signature database is continuously updated. Other methods aren’t based on matching known patterns: anomaly detection looks for deviations from normal behavior, protocol anomaly detection focuses on irregularities in protocol usage, and “file system intrusions” describes a type of attack rather than a detection technique.