What are the characteristics of anomaly based IDS?

• A. It models the normal usage of network as a noise characterization
• B. It doesn t detect novel attacks
• C. Anything distinct from the noise is not assumed to be intrusion activity
• D. It detects based on signature