► Anomaly-based IDSs (AKA behavior-based) start with a performance baseline of normal behavior and then identify anomalies.

► Signature-based IDSs (AKA definition-based) use a database of predefined traffic patterns. Read more ...