The suggested answer is B.
An anomaly-based IDS can identify unknown attacks by monitoring system activity and classifying it as either normal or anomalous. This classification is based on heuristics or rules, rather than patterns or signatures, which allows it to detect new, previously unknown threats. In contrast, signature-based IDS can only detect attacks for which a signature has previously been created, thus limiting their ability to identify new threats.