Which detection method involves comparing a predetermined profile of benign protocol activity for each protocol state against observed events to identify deviations?

• A. Anomaly-based detection
• B. Stateful protocol analysis
• C. SSL
• D. IPSEC

Answer: (B)

Stateful protocol analysis builds a model of legitimate protocol behavior, including the allowed sequences of messages and state transitions for each protocol state. It then monitors live traffic, maintaining the state for each connection and comparing what actually happens to the expected model. When observed events deviate from the defined state transitions or sequences, the system flags potential misuse or intrusion. This approach fits the description because it relies on a predetermined profile of benign protocol activity for each protocol state and checks observed activity against that profile to identify deviations. In contrast, anomaly-based detection uses a general behavioral baseline and may not enforce per-protocol state, and SSL/IPSEC are encryption mechanisms rather than detection methods.