In intrusion detection systems, which approach uses statistical models to establish a baseline of normal activity?

• A. Pattern matching
• B. Statistical-based anomaly detection
• C. Real-time anomaly detection
• D. Signature-based anomaly detection

Answer: (B)

Using statistical models to establish a baseline of normal activity means the system learns what typical behavior looks like from historical data and builds a model of that normal state. By analyzing features such as packet sizes, inter-arrival times, connection durations, and other metrics, the IDS estimates distributions and thresholds. When current activity falls outside these learned bounds or shows unlikely combinations of features, it is flagged as suspicious. This approach excels at catching new, unseen attacks because it doesn’t depend on known signatures; it detects deviations from normal behavior rather than matching fixed patterns.