## Detection Methodologies

How does the box know it's an attack?

### 1. Signature-Based (The Anti-Virus Model)
*   **Concept**: Pattern Matching.
*   **Example**: "If packet contains `0x909090` (NOP Sled) AND `cmd.exe` -> ALERT."
*   **Pros**: Fast, Low False Positives.
*   **Cons**: Blind to Zero-Days. If the attacker changes 1 byte of the payload, the signature fails. (e.g., `cmD.eXe`).

### 2. Anomaly-Based (Behavioral)
*   **Concept**: "This looks weird."
*   **Baseline**: The system learns "Normal". (e.g., "Web Server usually speaks HTTP on port 80").
*   **Alert**: "Web Server is speaking IRC on port 6667." -> ALERT.
*   **Pros**: Catches Zero-Days.
*   **Cons**: High False Positives. (Did the backup job start at a weird time? ALERT).

### 3. Protocol Analysis (Stateful)
*   **Concept**: Rules of the Road.
*   **Example**: "In TCP, after SYN, next must be SYN-ACK."
*   **Alert**: "Client sent ACK without SYN." -> ALERT (Malformed Packet / Scan).