Problem
A growing body of evidence suggests that collecting and filtering data based on knowledge of adversary tactics, techniques, and procedures (TTPs) is an effective method for detecting malicious activity.
i. Compare and contract signature and anomaly-based detection techniques.
ii. Why do you believe TTP-based detection may be superior to other detection techniques?