<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:times new roman, new york, times, serif;font-size:12pt"><DIV></DIV>
<P> </P>
<P><STRONG>Right answer is </STRONG></P>
<P><STRONG> D. Lack of ability to scale</STRONG></P>
<P> </P>
<P> </P>
<P> </P>
<P>The disadvantages of network-based IDSs include:</P>
<P> </P>
<DIV><STRONG>They are not very scaleable; they have struggled to maintain capacities of 100 Mbps.</STRONG></DIV>
<DIV>They are based on predefined attack signatures—signatures that will always be a step behind the latest underground exploits</DIV>
<DIV>IDS vendors have not caught up with all known attacks, and signature updates are not released nearly as frequently as antivirus updates.</DIV>
<P> </P>
<P> </P>
<P> </P>
<P><STRONG>Requirement to monitor every event</STRONG> </P>
<P> The primary host-based IDS purpose is to monitor systems for individual file changes.</P>
<P> </P>
<P><STRONG>Lack of learning model</STRONG> </P>
<P> This :is not weakness of statistical anomaly.</P>
<P> </P>
<P> </P>
<P><STRONG>Inability to run in real time</STRONG></P>
<P> Network-based IDSs typically utilise network adapters running in promiscuous mode to monitor and analyse network traffic in real time</P>
<P> </P>
<P> </P>
<P> </P>
<P>I hope you find useful</P>
<P> </P>
<P>HH</P>
<P> </P>
<DIV> </DIV>
<DIV><BR> </DIV>
<DIV style="FONT-FAMILY: times new roman, new york, times, serif; FONT-SIZE: 12pt">
<DIV style="FONT-FAMILY: times new roman, new york, times, serif; FONT-SIZE: 12pt"><FONT size=2 face=Tahoma>
<HR SIZE=1>
<B><SPAN style="FONT-WEIGHT: bold">From:</SPAN></B> Jef A. <jeff132@gmail.com><BR><B><SPAN style="FONT-WEIGHT: bold">To:</SPAN></B> The CISSP Study Mailing list <cisspstudy@cccure.org><BR><B><SPAN style="FONT-WEIGHT: bold">Sent:</SPAN></B> Fri, January 15, 2010 8:23:10 AM<BR><B><SPAN style="FONT-WEIGHT: bold">Subject:</SPAN></B> Re: [Cisspstudy] Question on IDS<BR></FONT><BR>This question confused me a bit also but this is my reasoning for choosing C. I was immediately able to rule out choices B & D because they just didn't apply. In regards to answer A i considered the idea that statistical anomaly detection is actually learning by comparing current activities to behavior that it believes to be normal. Pattern matching doesn't learn at all because it is only looking for a specific pattern, it is not capable of finding any deviations from that pattern. However the requirement to monitor every event is
something that both devices must do and i guess they are considering it a weakness.
<DIV><BR></DIV>
<DIV>i am curious to here what others have to say about this questions.<BR><BR>
<DIV class=gmail_quote>On Fri, Jan 15, 2010 at 6:22 AM, Saurabh Bhargava <SPAN dir=ltr><<A href="mailto:catchbhargava@yahoo.com" rel=nofollow target=_blank ymailto="mailto:catchbhargava@yahoo.com">catchbhargava@yahoo.com</A>></SPAN> wrote:<BR>
<BLOCKQUOTE style="BORDER-LEFT: #ccc 1px solid; MARGIN: 0px 0px 0px 0.8ex; PADDING-LEFT: 1ex" class=gmail_quote>
<DIV>
<DIV style="FONT-FAMILY: arial, helvetica, sans-serif; FONT-SIZE: 10pt">
<DIV><FONT size=4 face="'times new roman', 'new york', times, serif"><SPAN style="FONT-SIZE: 16px"><FONT size=3 face="arial, helvetica, sans-serif"><SPAN style="FONT-SIZE: 13px"><BR></SPAN></FONT></SPAN></FONT></DIV>
<DIV style="FONT-FAMILY: arial, helvetica, sans-serif; FONT-SIZE: 10pt">
<DIV style="FONT-FAMILY: times new roman, new york, times, serif; FONT-SIZE: 12pt">
<DIV style="FONT-FAMILY: arial, helvetica, sans-serif; FONT-SIZE: 10pt">Hello Everyone:
<DIV><BR></DIV>
<DIV>Need your thoughts on below question: </DIV>
<DIV><BR></DIV>
<DIV>1. which of the following is the is a weakness of both statistical anomaly detection and pattern matching </DIV>
<DIV><BR></DIV>
<DIV>A. Lack of learning model</DIV>
<DIV>B. inability to run in real time</DIV>
<DIV>C. Requirement to monitor every event</DIV>
<DIV>D. Lack of ability to scale</DIV>
<DIV><BR></DIV>
<DIV>I think answer is C but author says its A. </DIV>
<DIV><BR></DIV>
<DIV>My reasoning - Statistical IDS creates a profile of “normal” and compares activities to this profile. For that, its put in leaning mode and if an attack was happening during "learning" mode, it may go undetected in production environment as well. </DIV>
<DIV><BR></DIV>
<DIV>Pattern matching depends on signatures so may not be able to pick up "zero day" attacks. </DIV>
<DIV><BR></DIV>
<DIV><BR></DIV>
<DIV>Thoughts pls?</DIV>
<DIV><BR></DIV>
<DIV>cheers, SB</DIV>
<DIV><BR></DIV></DIV><BR></DIV></DIV>
<DIV></DIV></DIV><BR></DIV><BR>_______________________________________________<BR>cisspstudy mailing list<BR><A href="mailto:cisspstudy@cccure.org" rel=nofollow target=_blank ymailto="mailto:cisspstudy@cccure.org">cisspstudy@cccure.org</A><BR>http://cccure.org/mailman/listinfo/cisspstudy_cccure.org<BR><BR></BLOCKQUOTE></DIV><BR></DIV></DIV></DIV><!-- cg10.c1.mail.mud.yahoo.com compressed/chunked Sat Jan 16 13:11:18 PST 2010 --></div><br>
</body></html>