Four weeks ago a network administrator applied a new IDS and allowed it to gather baseline data.
As rumors of a layoff begins to spread, the IDS alerted the network administrator that access to
sensitive client files had risen for above normal. Which of the following kind of IDS is in use?
A.
Protocol based
B.
Heuristic based
C.
Signature based
D.
Anomaly based
Explanation:
Its B
Heuristic is the one that is smart and should stay on the network to learn the normal behavior and then decide which behavior is abnormal
Anomaly is kind of signature based