John, a network specialist at an organization, was instructed to monitor unusual behaviors in the network. He implemented an IDS system that first creates models of possible intrusions and then compares these models with incoming events to make a detection decision

Identify the type of IDS detection method employed by John in the above scenario.

Protocol anomaly detection

Not$-$use detection

Anomaly detection

Misuse detection