Anomaly-based IDS tends to produce the most false alarms because it relies on what?

• A. Predefined signatures
• B. Observed behavior
• C. Network topology
• D. User permissions

Answer: (B)

Anomaly-based intrusion detection relies on learning what normal activity looks like by observing behavior over time. Detection then flags anything that deviates from that learned baseline. Because normal behavior in real systems is fluid—new users, new applications, updates, backup windows, unusual but legitimate workloads, and seasonal or time-of-day changes—the system will often mark these legitimate deviations as suspicious. This leads to many alerts that turn out to be harmless, i.e., false positives. By contrast, signature-based systems depend on predefined patterns and are less prone to flag every day-to-day variation, though they can miss new threats. Network topology or user permissions aren’t the core reason for the high false alarm rate in anomaly-based systems.