Which type of IDS/IPS uses a baseline of normal network activity to identify unusual patterns or levels of network activity that may be indicative of an intrusion attempt?

The correct answer is C. Behavior-based. Behavior-based (also called anomaly-based) IDS/IPS works by first establishing a baseline profile of normal network traffic - typical bandwidth usage, connection rates, protocols in use, and communication patterns. It then continuously monitors live traffic and flags deviations f

Submitted by obi.ng· Apr 18, 2026Network Security

Question

Options

AKnowledge-based
BSignature-based
CBehavior-based
DDatabase-based

How the community answered

(59 responses)

A
7% (4)
B
2% (1)
C
88% (52)
D
3% (2)

Explanation

Behavior-based (also called anomaly-based) IDS/IPS works by first establishing a baseline profile of normal network traffic - typical bandwidth usage, connection rates, protocols in use, and communication patterns. It then continuously monitors live traffic and flags deviations from that baseline as potential intrusions. This allows it to detect novel, zero-day attacks that have no known signature. Signature-based (B) / Knowledge-based (A) detection matches traffic against a database of known attack patterns and cannot detect unknown threats. 'Database-based' (D) is not a recognized IDS classification.

Topics

#IDS/IPS#Behavioral IDS#Anomaly detection#Network security concepts

Community Discussion

No community discussion yet for this question.

Full PCCET Practice