Which IDS detection type compares current activity to baseline profiles or network behavior baselines?

Which IDS detection type compares current activity to baseline profiles or network behavior baselines?

• A. Signature-based
• B. Stateful
• C. Heuristic-based
• D. Anomaly-based

Answer: (D)

This item focuses on anomaly-based intrusion detection. Anomaly-based IDS establish a baseline of normal activity and continuously compare current behavior to that baseline. By learning what typical traffic patterns, protocol usage, login times, and user actions look like, the system can flag deviations as potential intrusions. This makes it especially good at catching novel or unknown attacks that don’t match any known signatures. However, it can generate more false positives if the baseline isn’t well defined or if normal behavior shifts over time. In contrast, signature-based detection relies on known attack patterns, heuristic-based detection uses general rules to flag suspicious behavior without relying on a behavioral baseline, and stateful detection focuses on the sequence and state of network connections rather than deviations from normal profiles.

This item focuses on anomaly-based intrusion detection. Anomaly-based IDS establish a baseline of normal activity and continuously compare current behavior to that baseline. By learning what typical traffic patterns, protocol usage, login times, and user actions look like, the system can flag deviations as potential intrusions. This makes it especially good at catching novel or unknown attacks that don’t match any known signatures. However, it can generate more false positives if the baseline isn’t well defined or if normal behavior shifts over time. In contrast, signature-based detection relies on known attack patterns, heuristic-based detection uses general rules to flag suspicious behavior without relying on a behavioral baseline, and stateful detection focuses on the sequence and state of network connections rather than deviations from normal profiles.