Composite-signature-based analysis uses a series of packets over time; ICMP floods example?

Composite-signature-based analysis uses a series of packets over time; ICMP floods example?

• A. Content-based signature analysis
• B. Atomic-signature-based analysis
• C. Composite-signature-based analysis
• D. Context-based signature analysis

Answer: (C)

Detecting complex network attacks requires looking at patterns across time rather than a single packet. Composite-signature-based analysis builds a signature from a sequence of events, correlating multiple packets over a period to identify abnormal behavior. An ICMP flood is not about one unusual packet; it’s about a rapid, sustained stream of ICMP Echo Requests. No single packet carries a distinctive payload that would trigger an atomic or content-based signature on its own. But when you observe a high rate of similar ICMP requests over a short interval, possibly from the same source, the series itself forms the signature. That temporal correlation is what lets composite signatures detect the flood pattern. In contrast, content-based analysis looks for malicious data within a single packet’s payload, which isn’t what a flood typically relies on. Atomic-signature-based analysis targets a single, specific pattern in one packet, which a flood may not exhibit. Context-based signature analysis uses surrounding context to assess risk, but the defining factor for a flood is the sequence and rate of packets over time, captured by composite signatures.

Detecting complex network attacks requires looking at patterns across time rather than a single packet. Composite-signature-based analysis builds a signature from a sequence of events, correlating multiple packets over a period to identify abnormal behavior. An ICMP flood is not about one unusual packet; it’s about a rapid, sustained stream of ICMP Echo Requests. No single packet carries a distinctive payload that would trigger an atomic or content-based signature on its own. But when you observe a high rate of similar ICMP requests over a short interval, possibly from the same source, the series itself forms the signature. That temporal correlation is what lets composite signatures detect the flood pattern.

In contrast, content-based analysis looks for malicious data within a single packet’s payload, which isn’t what a flood typically relies on. Atomic-signature-based analysis targets a single, specific pattern in one packet, which a flood may not exhibit. Context-based signature analysis uses surrounding context to assess risk, but the defining factor for a flood is the sequence and rate of packets over time, captured by composite signatures.