Which monitoring methodology will trigger the IDS if any application tries to scan multiple ports?

Question $57$ options:

a$)$

Signature$-$based monitoring

b$)$

Heuristic monitoring

c$)$

Behavior$-$based monitoring

d$)$

Anomaly$-$based monitoring