What are characteristics of anomaly based IDS ?

• A. It models the normal usage of network as a noise characterization
• B. It doesn’t detect novel attacks
• C. Anything distinct from the noise is not assumed to be intrusion activity
• D. It detects based on signature