A security engineer is deploying a next-generation IPS to protect a data center. Management wants the sensor to detect a brand-new exploit that has no published signature yet, by flagging traffic that deviates from a learned baseline of normal protocol behavior and traffic volume. Which IPS detection method meets this requirement?