Besides signature based analysis, IDPSs also use which kind of analysis?

1. A signature only matches an attack already known. 2. Detecting the unknown needs a different approach. 3. IDPSs also use signature-based and anomaly-based analysis to detect problems in network traffic. 4. So the answer is anomaly based. _Source: NIST SP 800-41 Rev. 1, 'Guidelines on Firewalls and Firewall Policy'_