1. Evaluation on anomaly vs. signature based detection.

As a fresh IT security professional, your boss asks you to evaluate an upcoming purchasing decision regarding several competing NIDS products. The two NIDS under consideration are an anomaly-based zero-day detector ZeroDayDetect and a signature-based system SigDetect.

Looking then through the incident reports of 2016, you observe a shift towards compromises due to web attacks. The attacker tools operated in a very stealthy fashion, but a sharp member of the security team found it was possible to identify the malicious web requests due the order of the HTTP headers in those requests. While HTTP does not require any particular order, the staff noticed that benign requests happen to use a different order. Assume you would not have known in advance that the attack traffic would have this appearance. Which tool would have been single most practical one for effectively and efficiently detecting these attacks?