English
Menu

Cyber Attacks and Defense in Practice

Which of the following correctly compares signature-based (misuse) detection and anomaly-based detection as IDS detection methods?

  1. ASignature-based detection matches known attack characteristics and tends to miss unknown attacks; anomaly-based detection finds deviations from normal and can notice unknown attacks but produces more false positives
  2. BSignature-based detection reliably detects even unknown attacks that are not registered, while anomaly-based detection can only detect known attacks registered in advance
  3. CAnomaly-based detection does not need to learn the normal state, so it can be used without false positives right after deployment, and no signature updates are needed
Show answer and explanation

Answer: A. Signature-based detection matches known attack characteristics and tends to miss unknown attacks; anomaly-based detection finds deviations from normal and can notice unknown attacks but produces more false positives

Signature-based detection registers the traffic characteristics (signatures) of known attacks in advance and detects whatever matches. It finds registered attacks accurately but tends to miss new attacks or attacks with slightly altered characteristics, and the signatures must be updated constantly. Anomaly-based detection learns the normal state (baseline), such as traffic volume, time of day and destinations, and detects large deviations from it, so it may notice unknown attacks. On the other hand, it tends to judge legitimate but rare traffic as abnormal, increasing false positives, so in practice the two are combined.

  • A. Correct. Signature-based detection, strong against known attacks, is combined with anomaly-based detection, which can notice unknown attacks but produces more false positives.
  • B. It is the other way round. Signature-based detection tends to miss unknown attacks that are not registered.
  • C. Anomaly-based detection needs a period to learn the normal state and tends to produce more false positives.
Practice this topic Back to topic

Books on Cyber Attacks and Defense in Practice Ad

As an Amazon Associate I earn from qualifying purchases.

More Cyber Attacks and Defense in Practice questions

  1. Which of the following correctly describes a WAF (web application firewall)?
  2. An organization places "decoy" files that nobody uses for work, and a decoy administrator account that no system uses, on an internal file server, and monitors access to them. Which of the following is the main advantage of this measure?
  3. The second revision (Rev. 2) of SP 800-61, the incident response guide published by the US NIST in 2012, presents incident response as a cycle of four phases. Which of the following gives the phases in the correct order?
  4. Evidence for an investigation is to be collected from a server where an incident occurred. Which of the following orders is the most appropriate according to the principle of collecting evidence in order of how easily it is lost (order of volatility)?
  5. Evidence from an incident investigation, such as a copy of a disk, is to be handled so that it can later be used in litigation or in a report to the police. Which of the following handling is the most appropriate according to the idea of chain of custody?

Comparisons in this topic