Messy, a network defender, was hired to secure an organization's internal network. He deployed an IDS in which the detection process depends on observing and comparing the observed events with the…

The correct answer is C. Anomaly-based. Anomaly-based IDS is a type of IDS that detects intrusions by comparing the observed network events with a baseline of normal behavior and identifying any deviation from it. Anomaly-based IDS can detect unknown or zero-day attacks that do not match any known signature, but they…

Network Security Controls

Question

Messy, a network defender, was hired to secure an organization's internal network. He deployed an IDS in which the detection process depends on observing and comparing the observed events with the normal behavior and then detecting any deviation from it. Identify the type of IDS employed by Messy in the above scenario.

Options

ASignature-based
BStateful protocol analysis
CAnomaly-based
DApplication proxy

How the community answered

(24 responses)

B
4% (1)
C
92% (22)
D
4% (1)

Explanation

Anomaly-based IDS is a type of IDS that detects intrusions by comparing the observed network events with a baseline of normal behavior and identifying any deviation from it. Anomaly-based IDS can detect unknown or zero-day attacks that do not match any known signature, but they can also generate false positives due to legitimate changes in network behavior. Anomaly-based IDS can use various techniques to model the normal behavior, such as statistical analysis, machine learning, or artificial intelligence. Anomaly-based IDS is the type of IDS employed by Messy in the above scenario, as he deployed an IDS that depends on observing and comparing the observed events with the normal behavior and then detecting any deviation from it.

Topics

#anomaly-based IDS#intrusion detection#baseline behavior#network monitoring

Community Discussion

No community discussion yet for this question.

Full 112-51 Practice