Question

Which of the following is an advantage of anomaly detection?

(a) Rules are easy to define

(b) Custom protocols can be easily analyzed

(c) The engine can scale as the rule set grows

(d) Malicious activity that falls within normal usage patterns is detected

I had been asked this question during an interview for a job.

My question is from Intrusion Detection Systems topic in portion Point to Point Protocol & Error Detection of Computer Network

Answer 1

Right choice is (c) The engine can scale as the rule set grows

The explanation is: Once a protocol has been built and a behavior defined, the engine can scale more quickly and easily than the signature-based model because a new signature does not have to be created for every attack and potential variant.