Network Security $($HW#$3)$

$$

Question$1.$ Complete the following sentences.

IDS uses known pattern matching to

signify attack

$[$Signature$-$based $-$ Anomaly$-$based $-$ Host$-$based $-$ Network$-$based$]$

$.$ IDS cannot detect attacks for which it

has no signature

$[$Signature$-$based $-$ Anomaly$-$based $-$ Host$-$based $-$ Network$-$based$]$

IDS uses statistical model or machine

learning engine to characterize normal usage behaviors.

$[$Signature$-$based $-$ Anomaly$-$based $-$ Host$-$based $-$ Network$-$based$]$

IDS Can detect attempts to exploit new

and unforeseen vulnerabilities

$[$Signature$-$based $-$ Anomaly$-$based $-$ Host$-$based $-$ Network$-$based$]$

IDS examines raw packets in the

network passively and triggers alerts

$[$Signature$-$based $-$ Anomaly$-$based $-$ Host$-$based $-$ Network$-$based$]$

IDS can analyze audit$-$trails, logs$,$

integrity of files and directories on a single host

$[$Signature$-$based $-$ Anomaly$-$based $-$ Host$-$based $-$ Network$-$based$]$

Question$2.$ Mark the following statements as true or false.

Coordinated DoS attack is harder to deal with compared to Simple

DoS attack.

In Simple DoS attack, the Attacker usually spoofed source address to

hide origin.

In Distributed DoS attacks, the handlers are usually home users with

DSL$/$Cable

In Distributed DoS attacks, the agents are usually very high volume

servers.