SECAI Core · phase 13 of 15 · noun
Signature matching
A technique in which predefined patterns are used to identify malicious activity.
The Explain card
- Plain English
- Signature matching identifies malicious activity by comparing observed data against a library of predefined patterns, such as byte sequences, hashes or strings.
- Example
- A prompt filter holds a list of known jailbreak phrasings. When a user submits a prompt containing one of them, the filter blocks it before the model ever sees it.
- Why it matters
- Signatures are fast, cheap and precise for known threats, which makes them the first line of defense. But they only catch what has been seen before, so attackers rephrase and slip past. Pair them with behavioral detection.
- Hook
- A wanted poster only works if the face has not changed.
Word knowledge
How the word is built, where it came from, and what it sits beside in memory.
In a sentence
The intrusion detection system uses signature matching to compare incoming network packets with patterns stored in its threat database.
Why these words
- signature Medieval Latin signatura, a marking or signature names the distinctive stored pattern
- matching Old English gemæcca, companion or equal, through the verb match expresses the act of comparing items for correspondence
Where it came from
- Origin
- English compound formed from signature and matching
- Entered the language
- 20th century
- What changed
- Signature broadened from a handwritten name or identifying mark to a distinctive technical pattern, while matching developed from pairing equals to computational comparison.
How it is spelled
- Pattern
- The suffix -ing is added directly to match because the final consonant is not doubled.
- Pattern
- The trigraph tch remains unchanged before -ing.
Spelled like
- catching
- fetching
- patching
Broken into chunks
-
sign
- signal
- signify
- signatory
-
match
- matched
- matcher
- mismatch
What it sits beside
Same subject
- intrusion detection
- malware scanning
- threat intelligence
- indicator of compromise
Same shape
- pattern matching
- string matching
- template matching
security detection methods
- signature matching
- anomaly detection
- behavioral analysis
comparison operations
- pattern matching
- string matching
- template matching
Where it sits in the deck
Phase 13: Detection, Monitoring, and Threat Intelligence
Defenses eventually fail — learn how to detect, correlate, and investigate anomalies in real time across both AI-specific and traditional security telemetry.
