Which statement would be a misconception about Anomaly-based detection?

A. matches only exact known signatures B. cannot learn baselines C. is used only for cable testing D. looks for deviations from normal behavior that may indicate attacks