An Intrusion Detection System (IDS) is based on the general hypothesis that a security violation is associated with a pattern of system usage which can be

The core hypothesis underlying IDS design is anomaly/signature detection: security violations produce system usage patterns (e.g., unusual login times, abnormal resource consumption, atypical network traffic) that can be differentiated from an established baseline of normal behavior. This principle applies to both anomaly-based IDS (statistical deviation) and signature-based IDS (known attack patterns), making 'differentiated from normal usage' the foundational and general hypothesis.

Detecting only known violations describes signature-based IDS specifically, not the general foundational hypothesis of all IDS systems, which must also account for anomaly-based detection.

Detecting a masquerader is one specific use case or application of IDS, not the broad underlying hypothesis upon which the entire IDS concept is built.

No IDS system is hypothesized to detect all security violations; this overstates the capability and does not accurately reflect the theoretical basis of IDS design.