ITPEC IP April 2024 Question 42

Monitoring the activity of programs and stopping any that behave suspiciously — behavioral detection judges a program by what it does, so it can catch malware nobody has seen before.

Signature-based (pattern-matching) antivirus compares files with the signatures of known malware, so a zero-day attack, which exploits a vulnerability before a fix or a signature exists, slips through. Behavioral detection instead watches what running programs actually do: unusual communication to an outside destination, mass encryption or deletion of files, changes to system settings, attempts to inject code into other processes. When the behavior looks malicious, the program is stopped, whether or not it matches any known signature.

Answer (c)

Why not others:

• •(a) — darkening the screen and showing a changing image after a period of no use is a screen saver; it hides the display from passers-by and does not look at programs at all
• •(b) — suspending an account after too many wrong passwords is account lockout, a defence against password guessing
• •(d) — converting harmful input strings into safe ones is sanitizing (escaping), a defence against injection attacks such as cross-site scripting and SQL injection

Key rule: Signature-based detection only recognises malware already known; behavior-based detection (like a sandbox) judges a program by its actions, which is what makes it useful against unknown and zero-day threats.

Security · AI-written, may contain errors