Which of the following is an IDS that acquires data and defines a "normal" usage profile for the network or host?

The correct answer is A. Statistical Anomaly-Based ID. A Statistical Anomaly-Based IDS (also called behavior-based IDS) works by first collecting data over a period of time to establish a baseline of what 'normal' network or host activity looks like. It then monitors ongoing activity and raises an alert when it detects deviations…

Submitted by anjalisingh· Apr 18, 2026Risk Identification, Monitoring and Analysis

Question

Options

AStatistical Anomaly-Based ID
BSignature-Based ID
Cdynamical anomaly-based ID
Dinferential anomaly-based ID

How the community answered

(49 responses)

A
88% (43)
B
6% (3)
C
4% (2)
D
2% (1)

Explanation

A Statistical Anomaly-Based IDS (also called behavior-based IDS) works by first collecting data over a period of time to establish a baseline of what 'normal' network or host activity looks like. It then monitors ongoing activity and raises an alert when it detects deviations from that baseline. This contrasts with Signature-Based IDS, which only detects known attack patterns by matching traffic against a database of predefined signatures. The other options (dynamical and inferential anomaly-based) are not standard IDS classifications.

Topics

#Intrusion Detection System (IDS)#Anomaly Detection#Statistical Analysis#Security Monitoring

Community Discussion

No community discussion yet for this question.

Full SSCP Practice