Which term describes a security monitoring concept combining network behavior and anomaly detection?

Which term describes a security monitoring concept combining network behavior and anomaly detection?

• A. NBAD
• B. Signature-based detection
• C. Behavioral-based detection
• D. EAPoL

Answer: (A)

Network Behavior Anomaly Detection focuses on how traffic behaves across the network and uses anomaly detection to spot deviations from normal patterns. NBAD builds a baseline of typical network activity—things like common sources and destinations, typical traffic volumes, timing, and protocol usage—and then watches for unusual changes. When current activity doesn’t fit the established pattern, alerts are generated, helping to identify unknown or stealthy threats that don’t match any known signature. This approach is particularly good at catching unusual data flows, rapid bursts, new lateral movements, or unusual access patterns that signature-based systems might miss because there’s no pre-existing pattern to match. Signature-based detection, by contrast, looks for known malicious patterns and requires updates to recognize new threats. EAPoL is unrelated here, as it’s a protocol used for network authentication. Behavioral-based detection is broader and can refer to host or user behavior, whereas NBAD specifically targets network-wide behavior and anomalies.

Network Behavior Anomaly Detection focuses on how traffic behaves across the network and uses anomaly detection to spot deviations from normal patterns. NBAD builds a baseline of typical network activity—things like common sources and destinations, typical traffic volumes, timing, and protocol usage—and then watches for unusual changes. When current activity doesn’t fit the established pattern, alerts are generated, helping to identify unknown or stealthy threats that don’t match any known signature. This approach is particularly good at catching unusual data flows, rapid bursts, new lateral movements, or unusual access patterns that signature-based systems might miss because there’s no pre-existing pattern to match.

Signature-based detection, by contrast, looks for known malicious patterns and requires updates to recognize new threats. EAPoL is unrelated here, as it’s a protocol used for network authentication. Behavioral-based detection is broader and can refer to host or user behavior, whereas NBAD specifically targets network-wide behavior and anomalies.