You run a security company for selling intrusion detection systems and youcurrently have two core technologies M a misuse-based signature-basedscheme; and A an anomaly-based scheme Suppose that M is a

1. Scheme M, because signature-based systems have lower false negative rates than anomaly-based systems.

b) Your company is considering expanding its product line to include a file-based intrusion detection system. Which of the following schemes would be best suited for this task (check only one): □ 1.) Scheme M, because it is network-based and can analyze individual files as they are transferred. □ 2.) Scheme A, because it is host-based and can analyze individual files as they are accessed. □ 3.) Neither scheme M nor A is well-suited for file-based intrusion detection. □ 4.) Both scheme M and A are equally well-suited for file-based intrusion detection. □ 5.) It is not clear without additional information which of schemes M or A would work better for file-based intrusion detection.

b) 1. Scheme M, because it is network-based and can analyze individual files as they are transferred