Which of the following is an obvious disadvantage of deploying misuse detectors?

A.
They are costly to setup.

B.
They are not accurate.

C.
They must be constantly updated with signatures of new attacks.

D.
They are costly to use.

Explanation:
Misuse detectors can only detect those attacks they know about – therefore they must be constantly
updated with signatures of new attacks. Many misuse detectors are designed to use tightly defined
signatures that prevent them from detecting variants of common attacks. Statebased misuse
detectors can overcome this limitation, but are not commonly used in commercial IDSs.