You are implementing a host based intrusion detection system on your web server. You feel that the best way to monitor the web server is to find your baseline of activity (connections, traffic…

Anomaly-based IDS works by first profiling normal system behavior - connections, traffic volume, resource usage - to establish a baseline. It then continuously compares current activity against that baseline and triggers alerts when deviations exceed a defined threshold. This method is effective for detecting novel or zero-day attacks that have no known signature.

Reactive IDS is not a standard IDS detection methodology - it describes a response posture, not a detection mechanism based on baselines.

Passive IDS describes how an IDS responds (monitoring only, no active blocking), not how it detects threats relative to a baseline.

Signature-based IDS detects threats by matching traffic against a database of known attack patterns, not by comparing against a learned baseline of normal behavior.