Question

When discussing IDS/IPS, what is a signature?

(a) An electronic signature used to authenticate the identity of a user on the network

(b) Attack-definition file

(c) It refers to “normal,” baseline network behavior

(d) It is used to authorize the users on a network

This question was posed to me during an online interview.

My enquiry is from Intrusion Detection Systems in portion Point to Point Protocol & Error Detection of Computer Network

Answer 1

The correct answer is (b) Attack-definition file

For explanation I would say: IDSes work in a manner similar to modern antivirus technology. They are constantly updated with attack-definition files (signatures) that describe each type of known malicious activity. Nemean is a popular signature generation method for conventional computer networks.