Detecting and Preventing Cyber Threats
Master Detecting and Preventing Cyber Threats for GCSE Computer Science with this free worksheet and full mark scheme — Foundation and Higher exam-style questions with worked answers. Measures include biometrics, password systems, CAPTCHA, email confirmation and automatic software updates.
Free downloads
These worksheets and mark schemes are original, written for Virtus Academy and checked against the current AQA specification. Every worksheet comes with a full mark scheme.
Topic overview
Detecting threats matters as much as preventing them, because no set of preventive measures is perfect.
Anti-malware software detects malicious programs in two ways. Signature-based detection compares files against a database of known malware patterns, which is reliable but only catches malware already in the database. Heuristic detection looks for suspicious behaviour instead, which can catch new malware but produces more false positives.
Other detection methods include monitoring network traffic for unusual patterns, auditing access logs to spot unexpected logins, and automatic alerts for events such as repeated failed password attempts. This is why anti-malware definitions must be updated constantly — a signature database that is a month old misses a month of new threats.
Revision notes
Signature-based detection
Files are compared against a database of known malware patterns.
Reliable and produces few false alarms, but only detects malware already in the database. This is why definitions must be updated constantly.
Heuristic detection
Looks for suspicious behaviour rather than known patterns.
Can detect new malware that has never been seen before, but produces more false positives — legitimate software occasionally behaves in ways that look suspicious.
Other detection methods
Monitoring network traffic for unusual patterns, such as large transfers at odd hours.
Auditing access logs to spot logins from unexpected locations. Automatic alerts for repeated failed password attempts, which suggest a brute force attack in progress.
Key points
- Detection matters as much as prevention.
- Signature detection compares against known patterns.
- It only catches malware already in the database.
- Definitions must be updated constantly.
- Heuristic detection looks for suspicious behaviour.
- Heuristics can catch new malware.
Worked examples
Example 1
Explain how signature-based malware detection works. [2 marks]
Working
Example 2
Explain why anti-malware definitions must be updated regularly. [2 marks]
Working
Example 3
State one advantage and one disadvantage of heuristic detection. [2 marks]
Working
Common mistakes
Saying anti-malware catches everything.
Signature detection misses anything not yet in the database.
Confusing signature and heuristic detection.
Signatures match known patterns; heuristics watch behaviour.
Forgetting why updates matter.
New malware appears constantly and needs new signatures.
Ignoring false positives.
They are the cost of heuristic detection.
Exam tips
- Distinguish signature from heuristic detection.
- Link updates to the signature database limitation.
- Mention false positives for heuristics.
- Name several detection methods beyond anti-malware.
Key terms
- Signature-based detection
- Comparing files against known malware patterns.
- Heuristic detection
- Detecting malware by suspicious behaviour.
- False positive
- Legitimate software wrongly flagged as malicious.
- Access log
- A record of who accessed a system and when.
Related topics
Written and reviewed against the current AQA specification. Spotted an error? Let us know.