Four weeks ago, a network administrator applied a new IDS and allowed it to gather baseline data.
As rumors of a layoff began to spread, the IDS alerted the network administrator that access to
sensitive client files had risen far above normal. Which of the following kind of IDS is in use?

A.
Protocol based

B.
Heuristic based

C.
Signature based

D.
Anomaly based