This approach enables the detection of previously unknown attacks .
It may suffer from false positives : previously unknown legitimate activity may also be classified as malicious .
Although this approach enables the detection of previously unknown attacks , it may suffer from false positives : previously unknown legitimate activity may also be classified as malicious .