Hi i hope im posting this in the correct area.
I did a piece of coursework and in the coursework i stated that Snort the Network Intrusion Detection System was both anomaly based and signature based.
My lecturer has marked the anomaly based part as wrong many times throughout my coursework. I don't understand why it isn't though becuase it uses anomaly based detection does it not? Can someone explain why i was wrong? I really want to understand it as i have an exam coming up.
Thanks