Several analysis methods can be employed by an IDS, each with its own strengths and weaknesses, and their applicability to any given situation should be carefully considered. There are two basic IDS…

Question

Options

• APattern Matching (also called signature analysis)
• BAnomaly Detection
• CHost-based intrusion detection
• DNetwork-based intrusion detection

• B
  91% (30)
• C
  3% (1)
• D
  6% (2)

Explanation

There are two fundamental IDS analysis methods: Pattern Matching (signature-based) and Anomaly Detection. Pattern matching compares observed traffic or behavior against a database of known attack signatures - it rarely produces false positives because it only alerts on exact or near-exact matches, but it misses novel/unknown attacks (false negatives). Anomaly Detection works by first establishing a baseline of 'normal' behavior, then alerting whenever observed behavior deviates significantly from that baseline. Because legitimate but unusual activity (a new application, a burst of authorized traffic, a user working odd hours) can look like an attack, anomaly detection is far more prone to false positives. Host-based (HIDS) and network-based (NIDS) describe the deployment location of an IDS, not its analysis method, so C and D are off-topic categories.

No community discussion yet for this question.