Which classification of IDS/IPS uses a database of known vulnerabilities and attack profiles to identify intrusion attempts?

The correct answer is B. Knowledge-based. A knowledge-based system uses a database of known vulnerabilities and attack profiles to identify intrusion attempts. These types of systems have lower false-alarm rates than behavior- based systems but must be continually updated with new attack signatures to be effective. A beh

Submitted by olafpl· Apr 18, 2026Network Security

Question

Options

AStatistical-based
BKnowledge-based
CBehavior-based
DAnomaly-based

How the community answered

(61 responses)

A
5% (3)
B
90% (55)
C
3% (2)
D
2% (1)

Explanation

A knowledge-based system uses a database of known vulnerabilities and attack profiles to identify intrusion attempts. These types of systems have lower false-alarm rates than behavior- based systems but must be continually updated with new attack signatures to be effective. A behavior-based system uses a baseline of normal network activity to identify unusual patterns or levels of network activity that may be indicative of an intrusion attempt. These types of systems are more adaptive than knowledge-based systems and therefore may be more effective in detecting previously unknown vulnerabilities and attacks, but they have a much higher false- positive rate than knowledge-based systems.

Topics

#IDS/IPS#Intrusion Detection#Signature-based Detection#Network Security Tools

Community Discussion

No community discussion yet for this question.

Full PCCET Practice