Analysis methodology Will it trap the port-scanning application? Comments Multi-conditional Signature Anomaly Behavioral Unlikely No No Depends Availability No Trend Possibly Heuristic Yes Port scanning usually does not involve looking for more than one condition. The application is new, and no signature of scanning by the port-scanning application has been created. Because the application is new, a baseline has not yet been established. Behavioral scanning could trap the application but only if the action by the application is different from other applications. Scanning would not prevent a network device from properly functioning. The volume of scan events could trigger a response. A response is triggered if any application tries to scan multiple ports.

Given a table of the eight different types of analysis, similar to the attached table. an then selected three recent attacks , and for each attack, explain if you think it could have been prevented by each of the data correlations.