A Manufacturing Company Recently Recovered from an Attack on Its

Multiple Choice

A manufacturing company recently recovered from an attack on its ICS devices. It has since reduced the attack surface by isolating the affected components. The company now wants to implement detection capabilities. It is considering a system that is based on machine learning. Which of the following features would BEST describe the driver to adopt such nascent technology over mainstream commercial IDSs?

A) Trains on normal behavior and identifies deviations therefrom
B) Identifies and triggers upon known bad signatures and behaviors
C) Classifies traffic based on logical protocols and messaging formats
D) Automatically reconfigures ICS devices based on observed behavior