CSSLP: Certified Secure Software Lifecycle Professional

An anomaly-based IDS learns or uses a baseline of normal network behavior and generates alerts when traffic significantly deviates from that baseline. A network-based IDS describes where monitoring occurs, whereas signature-based detection compares activity with known attack signatures.