Kalley, a network administrator of an organization, has installed a traffic monitoring system to capture and report suspicious traffic signatures. In this process, she detects traffic containing password cracking, sniffing, and brute-forcing attempts.Which of the following categories of suspicious traffic signature were identified by Kalley through the installed monitoring system?

The detected activities—password cracking, sniffing, and brute-forcing—are all methods used to circumvent authentication mechanisms and gain entry to systems or accounts without permission. These actions are characteristic of unauthorized access attempts, where the primary goal is to breach security controls and access protected resources. The traffic signatures generated by these activities directly indicate an attempt to gain illicit access.

A. Reconnaissance signatures relate to information gathering activities like port scanning or network mapping, which typically precede an actual access attempt.
C. Denial-of-service (DoS) signatures indicate attacks aimed at making a system or network resource unavailable to its intended users, not gaining access.
D. Informational signatures flag non-threatening, routine events that may be of interest for auditing, such as successful logins or policy updates.

1. Stallings, W., & Brown, L. (2018). Computer Security: Principles and Practice (4th ed.). Pearson. In Chapter 8, "Intrusion Detection," the text discusses classes of intruders and attack patterns. Brute-force attacks and password cracking are explicitly described as methods for masquerading or gaining illicit access (Section 8.2, "Intruders").

2. Kemmerer, R. A., & Vigna, G. (2002). Intrusion detection: a brief history and overview. Computer, 35(4), 27–30. https://doi.org/10.1109/MC.2002.1012428. This foundational paper on intrusion detection distinguishes between different attack phases, separating information gathering (reconnaissance) from attacks that exploit vulnerabilities to gain unauthorized access, which aligns with the classification in the question.

3. Porras, P. A., & Neumann, P. G. (1997). EMERALD: Event Monitoring Enabling Responses to Anomalous Live Disturbances. Proceedings of the 20th National Information Systems Security Conference. This paper, foundational for many intrusion detection systems, outlines a classification of attacks that includes "unauthorized access to information or resources," under which activities like password guessing and cracking fall (Section 3.2, "Signature Analysis").