Which of the following is an advantage of anomaly detection?

• A. Rules are easy to define
• B. Custom protocols can be easily analyzed
• C. The engine can scale as the rule set grows
• D. Malicious activity that falls within normal usage patterns is detected