IDS detects risky traffic by means of

• A. It uses heuristic anomaly detection to identify previously unseen threats
• B. Signatures enable detection of known threats; without them, detection may fail
• C. It relies on firewall rules to determine risk
• D. It cannot detect suspicious traffic at all

Answer: (B)

Signature-based detection is the method many IDS use to identify known threats by comparing traffic against a database of attack patterns. When traffic matches a stored signature, the IDS flags it as malicious. This approach is effective for known exploits because signatures reflect confirmed attack payloads, patterns, or sequences. Without up-to-date signatures, those known threats can slip through, which is why maintaining a current signature database is essential. While anomaly-based or heuristic detection can catch unusual or previously unseen behavior, the question emphasizes detecting known threats, which is best achieved through signature matching. Relying on firewall rules isn’t how an IDS typically operates, since firewalls control access and the IDS analyzes traffic for patterns; and an IDS can indeed detect suspicious traffic, so saying it cannot would be incorrect.