Which detects intrusion based on fixed behavioral characteristics of the users and components in a computer system?

Which detects intrusion based on fixed behavioral characteristics of the users and components in a computer system?

• A. Signature Recognition
• B. Anomaly Detection
• C. Protocol Anomaly Detection
• D. SIV

Answer: (B)

Intrusion detection based on fixed behavioral characteristics is anomaly detection. It works by building a baseline of normal activity for users and system components, then monitoring for deviations from that baseline. When behavior crosses a defined threshold—such as odd login times, unusual file access patterns, or atypical resource usage—the system flags it as a potential intrusion. This approach is strong for catching new or unknown attacks that don’t match any known signatures, because it focuses on abnormal behavior rather than specific attack patterns. Signature recognition would only catch attacks with known patterns, while protocol anomaly detection looks at protocol-level irregularities rather than overall user and component behavior. SIV isn’t a standard method for this kind of behavioral monitoring.

Intrusion detection based on fixed behavioral characteristics is anomaly detection. It works by building a baseline of normal activity for users and system components, then monitoring for deviations from that baseline. When behavior crosses a defined threshold—such as odd login times, unusual file access patterns, or atypical resource usage—the system flags it as a potential intrusion. This approach is strong for catching new or unknown attacks that don’t match any known signatures, because it focuses on abnormal behavior rather than specific attack patterns. Signature recognition would only catch attacks with known patterns, while protocol anomaly detection looks at protocol-level irregularities rather than overall user and component behavior. SIV isn’t a standard method for this kind of behavioral monitoring.