Anomaly-based intrusion detection systems compare current activity with stored profiles of normal (expected) activity.

Anomaly-based IDS pg. 250 is an intrusion detection system that compares current activity with stored profiles of normal (expected) activity. While an intrusion detection system that uses pattern matching and stateful matching to compare current traffic with activity patterns (signature) of known network intruders is Pattern - (signature) based IDS pg. 250.