Using a process known as network-based idpss look for attack patterns by comparing measured activity to known signatures in their knowledge base to determine whether or not an attack has occurred or may be under way. a. packet sniffing b. port monitoring c. traffic measurement d. signature matching