Some analysts break down IDS models even further into four categories depending on how the IDS operates and detects malicious traffic (the same models can also be applied to intrusion prevention systems, discussed a bit later). Which of these four categories would you choose to protect your network and discuss why you picked that one over the other three?