Which type of technology is used for detecting unusual patterns and anomalous behavior on a network?

Host intrusion detection (HIDS) monitors activity on individual endpoints such as file changes and system calls, not network-wide traffic patterns.

Host malware prevention focuses on stopping malicious software from executing on a specific host, not on detecting network-level behavioral anomalies.

NetFlow is a network protocol and analysis technology developed by Cisco that captures IP traffic statistics, including source/destination, volume, and timing. By baselining normal traffic patterns and comparing against collected flow records, security teams can detect anomalies such as unusual data exfiltration, port scans, or DDoS patterns across the entire network.

Web content filtering enforces URL and category-based access policies for web traffic, not behavioral or anomaly detection across all network flows.