Jason is considering deploying a network intrusion prevention system $($IPS$)$ and wants to be able to detect advanced persistent threats. What type of IPS detection method is most likely to detect the behaviors of an APT after it has gathered baseline information about normal operations?

Question $30$ options:

Signature$-$based IPS detections

Heuristic$-$based IPS detections

Malicious tool hash IPS detections

Anomaly$-$based IPS detections