Which of the following is true about heuristic-based algorithms?

Heuristic-based algorithms identify threats by analyzing behavioral patterns rather than fixed signatures, which means they can flag legitimate traffic as malicious. Because every network environment has different normal traffic patterns, these algorithms often require fine-tuning to reduce false positives and false negatives specific to that environment.

This is incorrect because heuristic algorithms are inherently probabilistic and environment-dependent, meaning fine-tuning is typically necessary to achieve acceptable accuracy.

Advanced malware protection is not a defining characteristic of heuristic algorithms specifically - it is a broader capability that may involve multiple detection methods.

Automation of IPS signature creation is associated with machine learning or AI-driven systems, not heuristic-based algorithms, which rely on predefined behavioral rules.