Question

Which of the following is true of signature-based IDSes?

(a) They alert administrators to deviations from “normal” traffic behavior

(b) They identify previously unknown attacks

(c) The technology is mature and reliable enough to use on production networks

(d) They scan network traffic or packets to identify matches with attack-definition files

This question was addressed to me in quiz.

This interesting question is from Intrusion Detection Systems in portion Point to Point Protocol & Error Detection of Computer Network

Answer 1

Right option is (d) They scan network traffic or packets to identify matches with attack-definition files

The explanation is: They are constantly updated with attack-definition files (signatures) that describe each type of known malicious activity. They then scan network traffic for packets that match the signatures, and then raise alerts to security administrators.