Bob Bobson is a security analyst for Goldmine Tech. He recently received a tip the Department of Homeland Security that the nefarious cybercriminal Zero Cool has boasted on an underground internet forum that he is actively infiltrating the Goldmine Tech computer network. What intrusion detection measures can he employ to detect Zero Cool's activities? In your opinion, what are the pros and cons of each?