Which intrusion detection approach creates models of possible intrusions and compares incoming events against these models to decide if an intrusion occurred?

Which intrusion detection approach creates models of possible intrusions and compares incoming events against these models to decide if an intrusion occurred?

• A. Anomaly detection
• B. Signature-based detection
• C. Misuse detection
• D. Protocol anomaly detection

Answer: (C)

This approach relies on predefined intrusion patterns and pattern matching. It builds models of known intrusion techniques and then compares incoming events to those models, flagging an intrusion when a match occurs. That is misuse detection in action, where the system looks for known attack patterns rather than modeling what normal behavior should look like. In contrast, anomaly detection models normal behavior and flags items that deviate from that baseline, and protocol anomaly detection checks for violations in protocol state transitions. Signature-based detection is closely related—recognizing known attack signatures—but the description here centers on matching against intrusion models, which aligns with misuse detection.

This approach relies on predefined intrusion patterns and pattern matching. It builds models of known intrusion techniques and then compares incoming events to those models, flagging an intrusion when a match occurs. That is misuse detection in action, where the system looks for known attack patterns rather than modeling what normal behavior should look like.

In contrast, anomaly detection models normal behavior and flags items that deviate from that baseline, and protocol anomaly detection checks for violations in protocol state transitions. Signature-based detection is closely related—recognizing known attack signatures—but the description here centers on matching against intrusion models, which aligns with misuse detection.