Bob finished a c programming course and created a small c application to monitor the network traffic and produce alerts when any origin sends "many" ip packets, based on the average number of packets sent by all origins and using some thresholds. in concept, the solution developed by bob is actually:
a. just a network monitoring tool
b. a signature-based ids
c. a hybrid ids
d. a behavior-based ids

A. Just a network monitoring tool.

Explanation:

Bob create the application using C language to monitor the network  traffic and the application produces alert when the origin sends many IP packets.

So the application created by bob is a simple network monitoring tool which monitors the network traffic and alerts when the send IP packets more than the threshold number of packets.

i think its d if im not mistaken

the file button then you go to insert tab and click insert hyperlink.