GISP: GIAC Information Security Professional Certification

An anomaly-based IDS builds a baseline profile of what normal network or system behavior looks like and then continuously compares observed traffic against that baseline. Any significant deviation from the established norm is flagged as a potential intrusion or anomaly. This differs from signature-based detection, which relies on matching traffic against a database of known attack signatures rather than a behavioral baseline.