Which of the following is an example of a behavioral-based HID technique?

The correct answer is B. Anomaly-based detection. Anomaly-based detection (B) is behavioral because it establishes a baseline of "normal" system activity and flags deviations from that baseline - it watches how the system behaves over time rather than looking for known bad patterns. A (Signature-based) is wrong because it…

Host Security

Question

Options

ASignature-based detection
BAnomaly-based detection
CHeuristic-based detection
DRule-based detection

How the community answered

(24 responses)

A
8% (2)
B
88% (21)
D
4% (1)

Explanation

Anomaly-based detection (B) is behavioral because it establishes a baseline of "normal" system activity and flags deviations from that baseline - it watches how the system behaves over time rather than looking for known bad patterns.

A (Signature-based) is wrong because it matches activity against a database of known attack signatures - pattern matching, not behavior observation.
C (Heuristic-based) is wrong because it uses rules or algorithms to score suspicious characteristics, placing it closer to rule/logic evaluation than pure behavioral profiling.
D (Rule-based) is wrong because it triggers on predefined conditions ("if X then alert"), which is static logic, not dynamic behavior tracking.

Memory tip: Think "Anomaly = Abnormal behavior" - if something acts differently from its normal self, anomaly detection catches it. Signatures need to know the threat in advance; anomaly detection doesn't.

Topics

#Intrusion Detection#Anomaly Detection#Behavioral Analysis#Detection Methods

Community Discussion

No community discussion yet for this question.

Full 303-300 Practice