There are two complementary approaches to detecting intrusions, knowledge-based approaches and behavior-based approaches. This entry describes the second approach. It must be noted that very few tools today implement such an approach, even if the founding Denning paper {D. Denning, An Intrusion Detection Model, IEEE transactions on software engineering} recognizes this as a requirement for IDS systems.
Behavior-based intrusion detection techniques assume that an intrusion can be detected by observing a deviation from normal or expected behavior of the system or the users. The model of normal or valid behavior is extracted from reference information collected by various means. The intrusion detection system later compares this model with the current activity. When a deviation is observed, an alarm is generated. In other words, anything that does not correspond to a previously learned behavior is considered intrusive. Therefore, the intrusion detection system might be complete (i.e. all attacks should be caught), but its accuracy is a difficult issue (i.e. you get a lot of false alarms).
Advantages of behavior-based approaches are that they can detect attempts to exploit new and unforeseen vulnerabilities. They can even contribute to the (partially) automatic discovery of these new attacks. They are less dependent on operating system-specific mechanisms. They also help detect 'abuse of privileges' types of attacks that do not actually involve exploiting any security vulnerability. In short, this is the paranoid approach: Everything which has not been seen previously is dangerous.
The high false alarm rate is generally cited as the main drawback of behavior-based techniques because the entire scope of the behavior of an information system may not be covered during the learning phase. Also, behavior can change over time, introducing the need for periodic online retraining of the behavior profile, resulting either in unavailability of the intrusion detection system or in additional false alarms. The information system can undergo attacks at the same time the intrusion detection system is learning the behavior. As a result, the behavior profile contains intrusive behavior, which is not detected as anomalous.
Herve Debar
IBM Zurich Research Laboratory
The following answers are incorrect:
Pattern matching systems are signature-based (e.g. Anti-virus).
Misuse detection systems is another name for signature-based IDSs.
Rule-based IDS is a distractor.
The following reference(s) were/was used to create this question:
Shon Harris AIO - 4th edition, Page 254
and
http://www.sans.org/security-resources/idfaq/behavior_based.php

Section: Asset Security

The correct answer is "Data normalization". Normalization includes eliminating redundant data and eliminating attributes in a table that are not dependent on the primary key of that table. In answer a, a database management system (DBMS) provides access to the database and is
used for maintaining the database. Answers "Data integrity" and "Data reuse" are distracters.

The underlying problem for a company with a lot of turnover is assuring that new employees are assigned the correct access permissions and that those permissions are removed when they leave the company.
Selecting the best answer requires one to think about the access control options in the context of a company with a lot of flux in the employee population. RBAC simplifies the task of assigning permissions because the permissions are assigned to roles which do not change based on who belongs to them. As employees join the company, it is simply a matter of assigning them to the appropriate roles and their permissions derive from their assigned role. They will implicitely inherit the permissions of the role or roles they have been assigned to. When they leave the company or change jobs, their role assignment is revoked/changed appropriately.
Mandatory access control is incorrect. While controlling access based on the clearence level of
employees and the sensitivity of obects is a better choice than some of the other incorrect
answers, it is not the best choice when RBAC is an option and you are looking for the best solution
for a high number of employees constantly leaving or joining the company.
Lattice-based access control is incorrect. The lattice is really a mathematical concept that is used
in formally modeling information flow (Bell-Lapadula, Biba, etc). In the context of the question, an
abstract model of information flow is not an appropriate choice. CBK, pp. 324-325
Discretionary access control is incorrect. When an employee joins or leaves the company, the
object owner must grant or revoke access for that employee on all the objects they own. Problems
would also arise when the owner of an object leaves the company. The complexity of assuring that
the permissions are added and removed correctly makes this the least desirable solution in this
situation.
References:
Alll in One, third edition page 165
RBAC is discussed on pp. 189 through 191 of the ISC(2) guide.