Protocol Anomaly Detection: Models are built on TCP/IP protocols using their specs.

Protocol Anomaly Detection: Models are built on TCP/IP protocols using their specs.

• A. Signature Recognition
• B. Anomaly Detection
• C. Protocol Anomaly Detection
• D. OSSEC

Answer: (C)

Protocol anomaly detection focuses on how a protocol should operate according to its specifications and builds models of normal, valid protocol behavior. By modeling the TCP/IP state machines and the allowed values and sequences for headers, flags, and payloads, it can detect traffic that deviates from the protocol rules—such as invalid flag combinations, out-of-sequence packets, or malformed headers. This makes it well suited to identify anomalies that arise from protocol misuse or protocol-level attacks, beyond simple byte-pattern matching. This approach is different from signature recognition, which looks for known attack patterns, and from generic anomaly detection, which may flag unusual activity without tying it to protocol semantics. OSSEC is a host-based system focusing on logs, file integrity, and signatures rather than modeling protocol behavior.

Protocol anomaly detection focuses on how a protocol should operate according to its specifications and builds models of normal, valid protocol behavior. By modeling the TCP/IP state machines and the allowed values and sequences for headers, flags, and payloads, it can detect traffic that deviates from the protocol rules—such as invalid flag combinations, out-of-sequence packets, or malformed headers. This makes it well suited to identify anomalies that arise from protocol misuse or protocol-level attacks, beyond simple byte-pattern matching.

This approach is different from signature recognition, which looks for known attack patterns, and from generic anomaly detection, which may flag unusual activity without tying it to protocol semantics. OSSEC is a host-based system focusing on logs, file integrity, and signatures rather than modeling protocol behavior.