Which IPS feature models worm behavior and correlates the specific time between events, network behavior, and multiple exploit behavior to more accurately identify and stop worms?

Which IPS feature models worm behavior and correlates the specific time between events, network behavior, and multiple exploit behavior to more accurately identify and stop worms?

A.
Risk Rating

B.
Meta Event Generator

C.
Security Device Event Exchange support

D.
traffic normalization