What is signature-based detection?

Intrusion detection systems (IDS) use several different techniques to detect malicious network activity. One method, signature-based detection, is designed to quickly identify patterns in network traffic that indicate malicious activity or unauthorized access. Malicious activity, often called malware, is an umbrella term that describes any malicious program or code that is harmful to computer systems (e.g., trojans, viruses, worms).

Signature-based detection is one of the most direct and well-established methods to identify malicious activity. Signature-based detection examines network traffic, compares it to known signatures, and generates an alert when a match is made. One example of an IDS that implements signature-based detections is Suricata. A Suricata signature consists of:

• Action - what happens when the signature matches
• Header - defining the network information (e.g., protocol, IP addresses, ports, and direction)
• Options - defining the specifics of the rule

Signature-based detections for networks is effectively the technology that is common to antivirus and endpoint tools where a unique pattern or identifier is matched.

Signature-based detection is a foundational method to identify malicious activity with an IDS, but it is not the only method. Signature-based detection has limitations; it is unable to detect patterns or indicators of new threats that are not already known. As a result, security professionals often use signature-based detections in conjunction with tools that provide context into network behavior.

What is a signature?

A signature is a unique pattern or identifier: It may be a byte sequence in network traffic or inside a file or a series of instructions. It is often compared to a fingerprint or DNA sample in that it belongs solely to that particular pattern. Others may have similar characteristics, but each malware type’s signature is its own.

A signature also may be identified as a threat signature or an IDS rule. These signatures are typically created by researchers or network defenders who identify and analyze malicious activity and extract indicators of compromise (IOCs).

Signature-based detection vs. anomaly detection

Anomaly-based or behavior-based detection takes a more comprehensive view of network activity and creates a baseline of patterns and behaviors that define “normal” activity. It is against this “normal” backdrop that anomaly-based detections operate, searching for a behavior that does not conform to the “normal” baseline that may indicate malicious activity. An anomaly or behavior-based detection system may leverage machine learning to establish the baseline or identify patterns that may be evidence of an attack.

The fundamental difference between signature-based and anomaly-based systems is crystallized by the ability, or lack thereof, to spot unknown or novel attack methods. Signature-based detections only generate alerts when they identify an exact match of a known indicator, any variation from the known indicator, and signature-based detection cannot identify the malicious activity. An anomaly-based system can generate alerts when activity is outside an accepted range. The activity may take the form of traffic that is not “normal” to the network or evidence of unusual attempts to connect to the network (e.g., with an unauthorized device). Anomaly-based detection may also deploy heuristic analysis, which focuses on identifying unknown threats through pattern creation, sandbox testing, and other methods to identify malicious activity or code that does not trigger alerts in a signature-based detection system.

Anomaly-based detection is not free of shortcomings, and one often discussed is the possibility of false positives generated by unusual, but not malicious, behavior.