# Bro as an Anomaly Detector. **URL:** \ **Category:** Zeek\ **Created:** [August 5, 2013, 7:43pm UTC](https://community.zeek.org/t/bro-as-an-anomaly-detector/2764 "2013-08-05T19:43:24Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Sheharbano\_Khattak](https://avatars.discourse-cdn.com/v4/letter/s/958977/32.png) [@Sheharbano\_Khattak](https://community.zeek.org/u/Sheharbano_Khattak)\ **Post date:** [August 5, 2013, 7:43pm UTC](https://community.zeek.org/t/bro-as-an-anomaly-detector/2764/1 "2013-08-05T19:43:24Z")
Dear Anil, Bro is more a network monitor than an anomaly detector. If you wish to write an anomaly detector, Bro’s domain scripting language will greatly simplify network analysis for you. I believe Bro doesn’t have the more involved machine learning style anomaly detection\* at the moment. However, there are some scripts for detection of SSH brute forcing, SQL injection attacks and malicious network scan that rely on deviation from a threshold. You will find these scripts in the directory /usr/local/bro/share/bro/scripts/policy (you might need to adjust the path depending on where you installed Bro on your machine). There is a new framework SumStats\*\* (Bro frameworks are similar to what we call libraries in most other languages–they facilitate tasks which would be otherwise rather tedious to perform) that simplifies the overall task of performing measurements over network data. Hope this helps. - You might be interested in looking at the paper [] to know why. \*\*[http://trac.bro-ids.org/sphinx-git/\_downloads/main16.bro](http://trac.bro-ids.org/sphinx-git/_downloads/main16.bro) Regards. ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/bro-as-an-anomaly-detector/2764/2 "2022-05-06T15:41:08Z")