Question: what is the difference between anomaly based monitoring and signature based monitoring?
Answer: While signature-based detection is used for threats we know, anomaly-based detection is used for changes in behavior. ... Anomaly-based detection involves first training the system with a normalized baseline and then comparing activity against that baseline. Once an event appears out of the ordinary an alert is triggered.