Which of the following intrusion detection techniques involves first creating models of possible intrusions and then comparing these models with incoming events to make a detection decision?

a) Anomaly-based detection
b) Signature-based detection
c) Behavior-based detection
d) Statistical-based detection