Definition
Signature-based detection is a method used in cybersecurity to identify and block malicious software or network activity. It works by comparing incoming data against a database of known threat patterns, called signatures. When a match is found, the system flags or quarantines the suspicious item. This approach is highly effective for detecting known threats, making it a cornerstone of many antivirus programs and intrusion detection systems. For instance, an antivirus program uses signature-based detection to identify a specific virus by its unique code sequence. It differs from anomaly-based detection, which looks for deviations from normal behavior rather than known bad patterns. Signature-based detection is a key concept tested on certifications like CompTIA Security+ and CySA+.