Signature-based detection
Course: AP® Cybersecurity Shows up in: Unit 3: Securing Networks
Detection that compares data to a database of known indicators of compromise; fast, almost no false positives, but cannot detect new attacks.
Appears in the course and exam description (CED): 3.5.C.13.5.D.13.5.D.3
Why it matters in Unit 3
Best for high-traffic networks; the database must stay updated.
Example
A packet matches the known pattern of a published malware family.
Learn it properly, with a checkpoint 3.5 Detecting Network Attacks