An IDS can perform many types of intrusion detections. Three common detection methods are signature-based, anomaly-based, and protocol-based. Which of the following best describes protocol-based detection?

• A. This detection method can include malformed messages and sequencing errors.
• B. It relies on known signatures alone.
• C. It analyzes user authentication patterns.
• D. It monitors port numbers for unusual activity.

Answer: (A)