Four weeks ago a network administrator applied a new IDS and allowed it to gather baseline data. As rumors of
a layoff begins to spread, the IDS alerted the network administrator that access to sensitive client files had risen
for above normal. Which of the following kind of IDS is in use?