I think as the attacks grows day by day so the focus should be on inreasing the performance of the security box. Because the anomaly detection is very useful in the cases of zero-day attack detection. Some times going thorugh the protocols or system specifications we can reach to the conclusion that if mentioned behovior is exploited then there is a attack. If you take a simple example of windows there path name should not be greater than 260 bytes, so in this case we can write anomaly to detect the attack case by wirting anomaly, this is a simple example there are many more. On the other hand if we write vulnerability based signature then that will trigger on that vunerability only and if the traffic is obfuscated then the signature will be evaded. There are many pros and cons that needs to be think about.