A Host-based Intrusion Prevention System (HIPS) software vendor records how the Firefox Web browser interacts with the operating system and other applications, and identifies all areas of Firefox func

Signature Matching compares activity or file hashes against a database of known malicious patterns, not against a learned profile of normal application behavior.

Application Behavior Monitoring involves recording and analyzing how an application normally interacts with the OS and other software to build a behavioral baseline. The HIPS then compares real-time activity against this baseline and raises alerts when the application acts outside its learned profile. This technique is capable of detecting novel or zero-day exploits that would bypass signature-based methods.

Host Based Sniffing refers to capturing and analyzing network packets at the host level, which is unrelated to profiling application-to-OS interactions.

Application Action Modeling is not a recognized standard HIPS feature term; the correct industry term for the described profiling and monitoring process is Application Behavior Monitoring.