Which method of detection does IDP Sensor use to detect rootkits or Trojans present on internal systems?

Which method of detection does IDP Sensor use to detect rootkits or Trojans present on internal
systems?

A.
Protocol Anomaly

B.
Network Honeypot

C.
Stateful Signatures

D.
Backdoor Detection