A server that normally exchanges a few megabytes daily with two internal databases suddenly starts connecting to dozens of internal hosts on SMB at night. No signature matches the traffic. Which detection approach is most likely to flag this?
Select an answer to reveal the explanation.
Short Explanation
Signatures are mugshots: they only catch criminals you've already photographed. Anomaly detection instead notices that the quiet neighbor is suddenly knocking on every door at 2 a.m. You don't need to know the malware's name to know that's not normal.
Full Explanation
Behavioral or anomaly detection uses machine learning or statistical models to learn a baseline for each host or entity, such as typical peers, protocols, volumes and times of activity, and raises an alert when current behavior deviates significantly. A server that suddenly fans out to dozens of hosts over SMB at night departs sharply from its baseline, which is a classic lateral movement or ransomware staging pattern, and can be flagged even when no signature exists. Signature-based IPS rules detect known exploit patterns; the stem states that no signature matches, so they would stay silent. File reputation checks examine file hashes against known-bad lists, which helps when a known malicious binary is transferred but does not evaluate connection behavior. An ACL blocking SMB between the server and its two databases targets the wrong traffic; the anomaly involves other hosts, and an ACL is a preventive rule, not a detection approach. Exam caveat: anomaly detection produces false positives when legitimate change occurs, such as a new backup job, so baselines need tuning and context. Operational check: review the alert's comparison of current peers and volumes against the host's baseline, then confirm with the server owner whether any change was scheduled.