Which type of IDS/IPS uses a baseline of normal network activity to identify unusual patterns or levels of network activity that may be indicative of an intrusion attempt?
The type of IDS/IPS that uses a baseline of normal network activity to identify unusual patterns or levels of network activity that may be indicative of an intrusion attempt is:
C. Behavior-based
Behavior-based intrusion detection and prevention systems (IDS/IPS) analyze the behavior and activities of network traffic or systems to detect anomalies or deviations from normal behavior. They establish a baseline of what is considered "normal" and then trigger alerts or block activity that deviates from that baseline. This approach is particularly effective at identifying new or previously unseen threats that may not have specific signatures or known patterns.
A behavior-based system uses a baseline of normal network activity to identify unusual
patterns or levels of network activity that may be indicative of an intrusion attempt.
IDSs and IPSs also can be classified as knowledge-based (or signature-based) or behavior-based (or statistical anomaly-based) systems:
● A knowledge-based system uses a database of known vulnerabilities and attack profiles
to identify intrusion attempts. These types of systems have lower false-alarm rates than
behavior-based systems but must be continually updated with new attack signatures to
be effective.
● A behavior-based system uses a baseline of normal network activity to identify unusual
patterns or levels of network activity that may be indicative of an intrusion attempt.
These types of systems are more adaptive than knowledge-based systems and therefore
may be more effective in detecting previously unknown vulnerabilities and attacks, but they have a much higher false-positive rate than knowledge-based systems
This section is not available anymore. Please use the main Exam Page.PCCET Exam Questions
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
emlee
8 months agoleipeG
1 year agosplashy
1 year, 3 months agocsco10320953
1 year, 10 months agoblahblah1234567890000
2 years, 1 month agoblahblah1234567890000
2 years, 1 month agoduckduckgooo
2 years ago