• (A) they alert administrators to deviations from “normal” traffic behavior
• (B) they identify previously unknown attacks
• (C) the technology is mature and reliable enough to use on production networks
• (D) they scan network traffic or packets to identify matches with attack-definition files