Which of the following intrusion detection systems (IDS) monitors network traffic and compares it against an established baseline?

File-based IDS monitors the integrity of system files by detecting unauthorized changes, not network traffic patterns against a behavioral baseline.

Anomaly-based IDS first learns what constitutes normal traffic patterns for a network and creates a statistical baseline. When current traffic deviates from this baseline beyond a defined threshold, an alert is triggered. This method is capable of detecting novel or zero-day attacks that signature-based systems would miss because it does not rely on known attack signatures.

Signature-based IDS compares network traffic against a database of known attack signatures or patterns, not against a learned behavioral baseline.

Network-based describes the deployment location of an IDS sensor (on the network segment), not the detection methodology used to identify intrusions.