In order to determine if network traffic adheres to expected usage and complies with technical standards, an organization would use a device that provides which functionality?

Protocol anomaly detection is a security mechanism that involves defining a model of legitimate network protocol behavior based on its technical standards (e.g., RFCs) and observed normal usage. A device using this functionality analyzes network traffic and flags any activity that deviates from this established baseline. This directly addresses the requirement to determine if traffic adheres to expected usage and complies with technical standards, as it can detect malformed packets or misuse of a protocol, even for novel attacks without a known signature.

A. Stateful packet filtering: This is a firewall function that tracks the state of network connections but does not perform deep analysis of protocol compliance against technical standards.
B. Signature matching: This method detects threats by looking for known, predefined patterns (signatures) of malicious activity and does not validate traffic against general protocol standards or normal usage.
D. CRC checking: Cyclic Redundancy Check is a function at the Data Link Layer (Layer 2) used to detect accidental errors during data transmission, not to enforce protocol standards.
E. Forward error correction: This is a data transmission technique used to detect and correct errors in transit, which is unrelated to verifying compliance with higher-level protocol standards.

1. National Institute of Standards and Technology (NIST) Special Publication 800-94, "Guide to Intrusion Detection and Prevention Systems (IDPS)," Revision 1, February 2012.

Section 3.3.2, Anomaly-Based Detection (Page 17): "One type of anomaly-based detection is protocol anomaly detection. Protocol anomaly detection models are typically based on the protocol standards (e.g., RFCs) for the protocols that are monitored... The IDPS understands the protocol and can identify traffic that is not compliant with the standard." This directly supports the correct answer.

2. Axelsson, S. (2000). "Intrusion detection systems: A survey and taxonomy." Chalmers University of Technology.

Section 3.2, Anomaly detection (Page 8): Discusses how anomaly detection systems build a profile of normal activity and detect deviations. It states, "The assumption is that an intrusion can be seen as an anomaly." This contrasts with signature-based methods and aligns with checking against "expected usage."

3. Kurose, J. F., & Ross, K. W. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson.

Chapter 6, The Link Layer and LANs, Section 6.2.2, "Error-Detection and -Correction Techniques": This section details how CRC is used for detecting bit errors caused by signal attenuation or noise in a link, confirming it is an error-control mechanism, not a protocol compliance tool.