_________ identification takes a very different approach to ...

[chandani]

_________ identification takes a very different approach to intrusion detection. The key feature of such systems is the use of rules for identifying known penetration or penetrations that would exploit known weaknesses.
 
  Typically the rules used in these systems are specific to the machine and operating system.
  What will be an ideal response?

Question 2

An example of a metric used for profile-based intrusion detection is _________ which is a non-negative integer that may be incremented but not decremented until it is reset by management action.
 
  Examples include the number of logins by a single user during an hour, the number of times a given command is executed during a single user session, and the number of password failures during a minute.
  What will be an ideal response?

[xiaomengxian]

Answer to Question 1

Rule-based penetration

Answer to Question 2

Counter

[chandani]

Excellent

[patma1981]

Great answer, keep it coming