How do Bros signatures work?
Like a number of other IDSs, such as Snort, Bro provides a signature-matching facility that looks for specific traffic content. For Bro, these signatures are expressed as regular expressions (for Snort, they are fixed strings). Bro adds a great deal of power to its signature-matching capability because its rich language allows it to not only examine the network traffic, but to understand the context of the signature, therefore greatly reducing the number of false positives, i.e., alerts that confuse uninteresting activity with the important attack activity.
