The Bro Scanner category is based on Bro's definition of a scanner: contacting at least 25 unique des­tinations on the same port within 5 minutes [46].
the mix of popular applications changes regularly [41], which reduces the predictability of IBR.