Which method is used by anomaly$-$based IDPS to detect intrusions?

Group of answer choices

Encrypting all data transfers on the network

Comparing current network activity to a baseline of normal activity

Blocking all traffic from external sources

Comparing user behavior to a database of known attack patterns