[Cisspstudy] Question on IDS

[Jef A.]

This question confused me a bit also but this is my reasoning for choosing
C. I was immediately able to rule out choices B & D because they
just didn't apply. In regards to answer A i considered the idea that
statistical anomaly detection is actually learning by comparing current
activities to behavior that it believes to be normal. Pattern matching
doesn't learn at all because it is only looking for a specific pattern, it
is not capable of finding any deviations from that pattern. However the
requirement to monitor every event is something that both devices must do
and i guess they are considering it a weakness.

i am curious to here what others have to say about this questions.

On Fri, Jan 15, 2010 at 6:22 AM, Saurabh Bhargava
<catchbhargava at yahoo.com>wrote:

>
> Hello Everyone:
>
> Need your thoughts on below question:
>
> 1. which of the following is the is a weakness of both statistical anomaly
> detection and pattern matching
>
> A. Lack of learning model
> B. inability to run in real time
> C. Requirement to monitor every event
> D. Lack of ability to scale
>
> I think answer is C  but author says its A.
>
> My reasoning - Statistical IDS creates a profile of “normal” and compares
> activities to this profile. For that, its put in leaning mode and if an
> attack was happening during "learning" mode, it may go undetected in
> production environment as well.
>
> Pattern matching depends on signatures so may not be able to pick up "zero
> day" attacks.
>
>
> Thoughts pls?
>
> cheers, SB
>
>
>
>
> _______________________________________________
> cisspstudy mailing list
> cisspstudy at cccure.org
> http://cccure.org/mailman/listinfo/cisspstudy_cccure.org
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://cccure.org/pipermail/cisspstudy_cccure.org/attachments/20100115/285aa9ea/attachment.html>