Which intrusion detection system will use well defined models of how an attack occurs?

Which intrusion detection system will use well defined models of how an attack occurs?

A.
Anomaly

B.
Protocol

C.
Signature

D.
Behavior