Which of the following intrusion detection systems (IDS) monitors network traffic and compares it
against an established baseline?
A.
Network-based
B.
Anomaly-based
C.
File-based
D.
Signature-based
Explanation:
The anomaly-based intrusion detection system (IDS) monitors network traffic and
compares it against an established baseline. This type of IDS
monitors traffic and system activity for unusual behavior based on statistics. In order to identify a
malicious activity, it learns normal behavior
from the baseline. The anomaly-based intrusion detection is also known as behavior-based or
statistical-based intrusion detection.
Answer option D is incorrect. Signature-based IDS uses a database with signatures to identify
possible attacks and malicious activity.Answer option A is incorrect. A network-based IDS can be a dedicated hardware appliance, or an
application running on a computer, attached
to the network. It monitors all traffic in a network or traffic coming through an entry-point such as
an Internet connection.
Answer option C is incorrect. There is no such intrusion detection system (IDS) that is file-based.