Which system detects intrusions by matching traffic against a database of known attack signatures?

Which system detects intrusions by matching traffic against a database of known attack signatures?

• A. IDS evasion
• B. ASCII shellcodes
• C. signature-based network intrusion detection system (NIDS)
• D. Polymorphic shellcode attacks

Answer: (C)

Matching traffic against a database of known attack signatures is the signature-based NIDS approach. This type of system keeps a library of signatures—patterns that reflect previously observed exploits or malicious behaviors—and scans network traffic in real time, raising alerts when a signature matches. It’s highly effective for known threats and can be very precise, but it relies on up-to-date signatures to catch new variants and may miss novel or heavily obfuscated attacks. The other options describe attacker techniques or encoding methods, not the detection mechanism itself.

Matching traffic against a database of known attack signatures is the signature-based NIDS approach. This type of system keeps a library of signatures—patterns that reflect previously observed exploits or malicious behaviors—and scans network traffic in real time, raising alerts when a signature matches. It’s highly effective for known threats and can be very precise, but it relies on up-to-date signatures to catch new variants and may miss novel or heavily obfuscated attacks. The other options describe attacker techniques or encoding methods, not the detection mechanism itself.