A. uses Netflow data for anomaly detections
B. builds baseline profilesof normal operating conditions， enablingrapid identification of unusual activity that indicates an attack
C. accept events inputs from different network devicesvia syslog， SDEE and SNMP
D. dynamic diversion redirects and cleans only traffic destined for targeted devices， allowing unaffectedtraffic toflow freely and ensuring business continuity
E. pushes ACLs to network devices to only block the malicious traffic
F. using topology and configuration awareness， events from different devices are correlatedand attacks mitgitations are performed at the optimal location