Which of the following statements about signature-based IDSes is incorrect?
A. They notify administrators when traffic behaviour deviates from "normal."
B. They spot attacks that were previously undetected.
C. The technology has matured to the point where it can be used on production networks.
D. They look for matches in network traffic or packets to attack-definition files.
Answer:D
Which of the following statements about signature-based IDSes is incorrect?
A. They notify administrators when traffic behaviour deviates from "normal." B. They spot attacks that were previously undetected. C. The technology has matured to the point where it can be used on production networks. D. They look for matches in network traffic or packets to attack-definition files.
Explanation: They're updated on a regular basis with attack-definition files (signature files) that explain each form of known harmful activity. They then monitor network traffic for packets matching the signatures and send security administrators alerts.