Can someone explain why Bro is said "behavioral" IDS and give an example ? I understand Bro can perform protocol analysis, DPI, by its analyzers, but what about "behavioral" ? Thanks in advance.