A junior administrator bursts into your office with a report in his hand. He claims that he has found documentation proving that an intruder has been entering the network on a regular basis. Which of the following implementations of IDS detects intrusions based on previously established rules that are in place on your network?
a. MD-IDS
b. AD-IDS
c. HIDS
d. NIDS
Answer: A
By comparing attack signatures and audit trails, a misuse-detection IDS determines whether an attack is occurring.