Which system detects intrusions by matching traffic against a database of known attack signatures?

• A. IDS evasion
• B. ASCII shellcodes
• C. signature-based network intrusion detection system (NIDS)
• D. Polymorphic shellcode attacks

Answer: (C)

Matching traffic against a database of known attack signatures is the signature-based NIDS approach. This type of system keeps a library of signatures—patterns that reflect previously observed exploits or malicious behaviors—and scans network traffic in real time, raising alerts when a signature matches. It’s highly effective for known threats and can be very precise, but it relies on up-to-date signatures to catch new variants and may miss novel or heavily obfuscated attacks. The other options describe attacker techniques or encoding methods, not the detection mechanism itself.