How does Bro detect intrusions?
Bro analyzes network traffic against rules describing what sort of activity is deemed troublesome. These rules might describe restrictions on activity (e.g., only certain hosts can connect to certain services), policies regarding what activity is worth alerting (e.g., attempts to a given number of different hosts constitutes a “scan”), or signatures describing known attacks or access to known vulnerabilities.
