Which detection method is commonly associated with signature-based detection in network security monitoring?

• A. Anomaly-based detection
• B. Heuristic detection
• C. Reputation-based detection
• D. Signature-based detection

Answer: (D)

Signature-based detection compares observed data against a catalog of known threat patterns. In network security monitoring, this approach uses a database of signatures—precise patterns such as specific byte sequences, file hashes, URLs, or protocol indicators—to quickly identify malicious activity when a match is found. This makes it highly effective for known threats because the signatures are exact and can trigger fast alerts or blocks with high confidence. However, it relies on keeping the signature database up to date, and it may miss new or obfuscated attacks that don’t match any existing signature. This is why other methods exist—anomaly-based detection flags unusual behavior compared to normal baselines, heuristic detection uses approximate rules to infer malicious intent, and reputation-based detection weighs the trustworthiness of sources like IPs or domains.