which of the following method to perform intrusion detection observes patterns of behavior of authorized individuals and then looks for activities that fall outside of the established patterns as it may indicate an intruder?