Which of the following attack signature analysis techniques are implemented to examine the header information and conclude that a packet has been altered?

Composite signature-based analysis, also known as stateful signature analysis, is used to detect attacks that span multiple packets. However, it can also refer to signatures that combine multiple conditions or checks within a single packet. To determine if a packet header has been maliciously altered (e.g., in a LAND attack or Xmas scan), the system must examine a combination of header fields (like source/destination IP addresses or multiple TCP flags). This correlation of multiple header attributes within a packet constitutes a composite signature.

A. Context-based analysis considers the broader network context and protocol state, which is more complex than just checking if a single packet's header is altered.
B. Content-based signature analysis primarily inspects the packet's payload for malicious strings or code, not the header information.
C. Atomic signature-based analysis looks for a single, simple event or pattern in a packet, which is often insufficient for detecting complex header alterations.

1. Kruegel, C., & Vigna, G. (2003). Alert Correlation in a Collaborative Intrusion Detection Framework. ACM Transactions on Information and System Security, 6(4), 414–451. (The paper discusses composite events, which require correlating multiple basic events, analogous to composite signatures checking multiple packet attributes). https://doi.org/10.1145/950191.950193

2. Scarfone, K., & Mell, P. (2007). Guide to Intrusion Detection and Prevention Systems (IDPS). (NIST Special Publication 800-94). National Institute of Standards and Technology. Section 3.2.1, p. 3-4. (Describes stateful analysis, which is a form of composite analysis over time).