Which of the following options represents a conceptual characteristic of an anomaly-based IDS over a signature-based IDS?

Anomaly-based IDSs are typically prone to producing more false positives than signature-based IDSs because any unusual, yet legitimate, activity can trigger an alert.

Anomaly-based IDSs establish a baseline of normal system or network behavior and flag any significant deviations from this baseline as potential intrusions, enabling them to identify novel or previously unknown attacks (zero-day threats) without requiring specific signatures.

Anomaly-based IDSs do not rely on vendor updates for new threats in the same manner as signature-based systems; their strength lies in detecting deviations from a learned normal behavior.

Both anomaly-based and signature-based IDSs face challenges in inspecting encrypted network traffic if decryption keys are not available, so this is not a distinguishing characteristic of anomaly-based IDS over signature-based.