How does statistical detection differ from rule-based detection?

This statement is incomplete and does not clearly define the distinct mechanisms of statistical versus rule-based detection.

Statistical detection models what constitutes 'legitimate data' or normal behavior over a period of time, then alerts on activities that deviate significantly from this established baseline. In contrast, rule-based detection operates by evaluating events against a predefined set of rules or signatures that describe known attack patterns or suspicious conditions.

This choice incorrectly reverses the definitions; rule-based detection relies on predefined rules, and statistical detection models behavior over time.

This choice incorrectly reverses the core functionalities, stating that rule-based defines legitimate data and statistical works on predefined rules, which is opposite to their actual mechanisms.