Which IDS system uses a baseline of normal activity and then sends an alert if the activity deviates significantly from this baseline?

Question

Quizplus · Accepted Answer

Anomaly-based IDS uses a baseline of normal activity and then sends an alert if the activity deviates significantly from this baseline. System-based IDS monitors the events occurring within a system while network-based IDS examines network traffic. Host-based IDS is installed on individual hosts to monitor activity on that host.

Which IDS System Uses a Baseline of Normal Activity and Then