Which IPS feature models worm behavior and correlates the specific time between events, network behavior and multiple exploit behavior to more accurately identify and stop worms?

Which IPS feature models worm behavior and correlates the specific time between events,
network behavior and multiple exploit behavior to more accurately identify and stop worms?

A.
Meta Event Generator

B.
Security Device Event Exchange support

C.
Risk Rating

D.
Traffic normalization