In an IS audit of several critical servers, the IS auditor wants to analyze audit trails to discover potential anomalies in user or system behavior. Which of the following tools are MOST suitable for performing that task? 
A、CASE tools 
B、Embedded data collection tools 
C、Heuristic scanning tools 
D、Trend/variance detection tools