Which of the following refers to a form of ids/ips detection based on a collection of samples, patterns, signatures, and so on stored in a database of known malicious traffic and events? all traffic or events that match an item in the database are considered abnormal and potentially malicious.

Correct answer to the following question is database based detection.

Explanation:

It can record the reference of database dumps in the network traffics and in the text documents. This type of technology make it possible for quickly intercept copied the database information and determine the mail-factor and blocks the transfers of data to the outside parties, and to collect the digital evidence of incidents for the investigative or the legal purposes.

i think ninja is the best