The difference between anomaly based monitoring and signature based monitoring is that with anomaly based monitoring can classify activities as normal or as an anomaly. With signature based monitoring, attacks can only be detected once a signature for that specific attack has been created.