200-201 · Question #525
How does the approach of a behavioral detection system to identifying security threats compare to that of a rule-based detection system?
The correct answer is C. Behavioral detection is adaptive to deviations, and rule-based detection uses static rules.. Behavioral detection systems identify threats by adaptively learning baselines and flagging deviations from normal activity, while rule-based detection systems rely on static, predefined rules to identify known threat patterns.
Question
How does the approach of a behavioral detection system to identifying security threats compare to that of a rule-based detection system?
Options
- ARule-based detection is effective with fewer false positives, and behavioral adapts over time.
- BBehavioral detection is easier to deploy without rules, and rule-based needs historical data.
- CBehavioral detection is adaptive to deviations, and rule-based detection uses static rules.
- DRule-based detection excels at APT hunts with updates, and behavioral focuses on anomalies.
How the community answered
(49 responses)- A6% (3)
- B2% (1)
- C90% (44)
- D2% (1)
Why each option
Behavioral detection systems identify threats by adaptively learning baselines and flagging deviations from normal activity, while rule-based detection systems rely on static, predefined rules to identify known threat patterns.
Rule-based systems can often generate many false positives if rules are not finely tuned, and while behavioral systems adapt, they can also have false positives initially.
Behavioral detection often requires historical data to build a baseline of normal behavior, and rule-based systems are deployed with predefined rules, not necessarily needing historical data themselves for their core function.
Behavioral detection systems establish a baseline of normal activity and use machine learning to identify anomalies or deviations from that baseline, making them adaptive to new threats. In contrast, rule-based systems rely on a predefined set of static rules or signatures to detect known attack patterns, meaning they only flag what they are explicitly configured to recognize.
While behavioral detection does focus on anomalies, rule-based detection, particularly signature-based, struggles with advanced persistent threats (APTs) that often employ novel techniques, unlike what's implied by "excels at APT hunts with updates."
Concept tested: Behavioral vs. Rule-based detection systems
Source: https://learn.microsoft.com/en-us/azure/security-center/security-center-detection-capabilities
Topics
Community Discussion
No community discussion yet for this question.