Which of the following is an advantage of anomaly detection?

• A. rules are easy to define
• B. custom protocols can be easily analyzed
• C. the engine can scale as the rule set grows
• D. malicious activity that falls within normal usage patterns is detected