Which type of detection looks at traffic patterns for deviations from set norms?

• A. Signature
• B. Anomaly
• C. Both A and B
• D. Neither A nor B

Answer: (B)

Anomaly-based detection analyzes traffic patterns against a baseline of normal behavior and flags deviations from that baseline. It works by monitoring what typical traffic looks like and then alerting when activity drifts away from those norms, which helps catch unknown or zero-day threats that don’t match any known signature. Signature-based detection, by contrast, relies on known patterns of malicious activity and flags traffic that matches those exact signatures rather than looking for deviations from a normal baseline. While some systems may combine both approaches, the scenario described—looking for deviations in traffic patterns—points to anomaly-based detection as the correct choice.