Which of the following statements is true about a Trojan engine?

Limiting system resource usage describes a function of resource throttling or rate-limiting controls, which is not a capability or purpose of a Trojan detection engine.

Watching for a host or network sending multiple packets matching signatures describes signature-based or threshold detection logic found in a general signature engine, not a Trojan-specific engine.

Detecting events that occur in a related manner within a sliding time interval describes the behavior of a correlation or anomaly-based detection engine, not a Trojan engine.

A Trojan engine within an intrusion detection system is specifically designed to identify traffic patterns and command-and-control communications associated with known Trojan horse programs that operate on nonstandard, proprietary protocols. Tools such as TFN2K (Tribe Flood Network 2000) and BO2K (Back Orifice 2000) communicate using custom protocols that bypass standard port and application analysis, and the Trojan engine targets these specific protocol fingerprints to detect their presence on a network.