Which of the following is true of signature-based IDSes?

• A. They alert administrators to deviations from “normal” traffic behavior
• B. They identify previously unknown attacks
• C. The technology is mature and reliable enough to use on production networks
• D. They scan network traffic or packets to identify matches with attack-definition files