2 cissp ® Official Study Guide Eighth Edition

Knowledge- and Behavior-Based Detection
An IDS actively watches for suspicious activity by monitoring network traffic and inspect-
ing logs. For example, an IDS can have sensors or agents monitoring key devices such as 
routers and firewalls in a network. These devices have logs that can record activity, and the 
sensors can forward these log entries to the IDS for analysis. Some sensors send all the data 
to the IDS, whereas other sensors inspect the entries and only send specific log entries based 
on how administrators configure the sensors.
The IDS evaluates the data and can detect malicious behavior using two common meth-
ods: knowledge-based detection and behavior-based detection. In short, knowledge-based 
detection uses signatures similar to the signature definitions used by anti-malware soft-
ware. Behavior-based detection doesn’t use signatures but instead compares activity against 
a baseline of normal performance to detect abnormal behavior. Many IDSs use a combina-
tion of both methods.
Knowledge-Based Detection
The most common method of detection is 
knowledge-based 
detection
(also called 
signature-based detection
or pattern-matching detection). It uses a 
database of known attacks developed by the IDS vendor. For example, some automated 
tools are available to launch SYN flood attacks, and these tools have known patterns 
and characteristics defined in a signature database. Real-time traffic is matched against 
the database, and if the IDS finds a match, it raises an alert. The primary drawback for 
a knowledge-based IDS is that it is effective only against known attack methods. New 
attacks, or slightly modified versions of known attacks, often go unrecognized by the IDS.
Knowledge-based detection on an IDS is similar to signature-based detection used by anti-
malware applications. The anti-malware application has a database of known malware and 
checks files against the database looking for a match. Just as anti-malware software must 
be regularly updated with new signatures from the anti-malware vendor, IDS databases 
must be regularly updated with new attack signatures. Most IDS vendors provide auto-
mated methods to update the signatures.