Behavior-based monitoring is proactive because it <em>aims to monitor deviant behaviors in order to catch patterns </em>regarding them. It aims to anticipate a future crisis, acting before it occurs.
Anomaly and signature-based monitoring have limitations because they are more reactive, meaning it centers on<em> reacting to the past, not focusing much on the future. </em>
Explanation: Both signature-based and anomaly-based monitoring systems are considered as being reactive based on the fact that, In signature-based monitoring, threat and attacks can only be detected or monitored based on previous threat patterns, meaning tm attacks with a new pattern or signature will go undetected. For the anomaly-based monitoring, it contains a set of rules regarded as norm and flags any process which deviates as a threat.
However, the behavior based monitoring is more adaptive and proactive, it looks at evidence rather than a static or previously established signature which a uses a reactive approach.
