A. It is programmed to interpret a certain series of packets
B. It models the normal usage of the network as a nosie characterization
C. They are integrated closely with the TCP/IP stack and watch packetsD. The host operating system logs in the audit information