問70
頻出度★★★
ゼロデイ攻撃のような未知の脅威からシステムを守るための, 振る舞い検知の技術に関する記述として, 適切なものはどれか。
平成29年度 秋期 ITパスポート試験 問70
This question's explanation and your answers so far.
解説
問 70
Incorrectア
Dimming the screen or displaying a changing image when the PC has not been operated for a certain time is a function of a screen saver or automatic screen lock (power saving / preventing shoulder-surfing), and has nothing to do with behavior-based detection, which monitors program behavior to detect threats.
Incorrectイ
Suspending an account when incorrect passwords are entered consecutively beyond a specified number of times is an account-lock mechanism, which is a countermeasure against brute-force attacks. It merely counts the number of authentication failures and does not monitor the behavior of programs, so it does not qualify as behavior-based detection against unknown threats.
- ウ
正解 Behavior-based detection (the behavior method / anomaly detection) is a technology that constantly monitors the actions of programs and blocks suspicious behavior, such as unintended communication to the outside, when it finds it. Unlike the approach of matching against the characteristics of known malware (signatures / pattern files), it captures anomalies in the behavior itself, so it can also handle unknown threats not yet registered in the pattern database, as well as zero-day attacks. The description that matches this is ウ.
Incorrectエ
Finding a harmful character string in the content entered by the user and replacing it with a harmless one is input sanitization (sanitizing / escaping) that prevents attacks such as SQL injection and cross-site scripting. It is an inspection of input data and differs from behavior-based detection, which monitors the actions of programs to block suspicious behavior.
ここがポイント
- Behavior-based detection (the behavior method) does not rely on signature matching but monitors and blocks anomalies in program behavior, so it is effective against unknown threats such as zero-day attacks.
- Grasp the difference from the pattern-matching type (matching against known characteristics). ア = screen lock, イ = account lock, エ = input sanitization — do not confuse these separate security measures with one another.
用語