Which intrusion detection approach uses models of potential intrusions and compares them with incoming events to detect misuse?

Which intrusion detection approach uses models of potential intrusions and compares them with incoming events to detect misuse?

• A. Anomaly Detection
• B. Signature Recognition
• C. Protocol Anomaly Detection
• D. File System Intrusions

Answer: (A)

Anomaly-based intrusion detection relies on a model of normal behavior and continuously compares incoming events to that model. When activity deviates beyond what the model considers usual, it raises alerts as potential misuse. This approach is strong for catching new or unknown attacks because it doesn’t depend on a predefined list of signatures; it flags unusual patterns rather than specific known exploits. Of course, it can trigger false positives if legitimate behavior changes or the model isn’t well-tuned. By contrast, signature-based methods detect only known attack patterns, protocol-focused anomaly detection narrows the scope to protocol behaviors, and file-system intrusions describe an area of activity rather than a detection method.

Anomaly-based intrusion detection relies on a model of normal behavior and continuously compares incoming events to that model. When activity deviates beyond what the model considers usual, it raises alerts as potential misuse. This approach is strong for catching new or unknown attacks because it doesn’t depend on a predefined list of signatures; it flags unusual patterns rather than specific known exploits. Of course, it can trigger false positives if legitimate behavior changes or the model isn’t well-tuned. By contrast, signature-based methods detect only known attack patterns, protocol-focused anomaly detection narrows the scope to protocol behaviors, and file-system intrusions describe an area of activity rather than a detection method.