Astatistical anomaly-based intrusion detection system:

A.
Acquires data to establish a normal system operating profile.

B.
Will detect an attack that does not significantly change the system’s operating characteristics.

C.
Does not report an event that caused a momentary anomaly in the system.

D.
Refers to a database of known attack signatures.

Explanation:
The correct answer is “Acquires data to establish a normal system operating profile”. A statistical
anomaly-based intrusion detection system acquires data to establish a normal system operating
profile. Answer “Refers to a database of known attack signatures” is incorrect because it is used in
signature-based intrusion detection. Answer “Will detect an attack that does not significantly change
the system’s operating characteristics.” is incorrect because a statistical anomaly-based intrusion
detection system will not detect an attack that does not significantly change the system operating
characteristics. Similarly, answer “Does not report an event that caused a momentary anomaly in the
system.” is incorrect because the statistical anomaly-based IDS is susceptible to reporting an event
that caused a momentary anomaly in the system.