Which of the following best describes signature-based detection? 

Answer options:

A. Compare source code, looking for events or sets of events that could cause damage to a system or network.
B. Compare system activity for the behaviour patterns of new attacks.
C. Compare system activity, looking for events or sets of events that match a predefined pattern of events that describe a known attack.
D. Compare network nodes looking for objects or sets of objects that match a predefined pattern of objects that may describe a known attack.

C

Misuse detectors compare system activity, looking for events or sets of events that match a predefined pattern of events that describe a known attack.As the patterns corresponding to known attacks are called signatures, misuse detection is sometimes called "signature-based detection." The most common form of misuse detection used in commercial products specifies each pattern of events corresponding to an attack as a separate signature. However, there are more sophisticated approaches to doing misuse detection (called "state-based" analysis techniques) that can leverage a single signature to detect groups of attacks. Reference: Old Document: BACE, Rebecca & MELL, Peter, NIST Special Publication 800-31 on Intrusion Detection Systems, Page 16. The publication above has been replaced by 800-94 on page 2-4 The Updated URL is:http://csrc.nist.gov/publications/nistpubs/800-94/SP800-94.pdf