Bro: https://en.wikipedia.org/wiki/Bro_(software)
There are "signatures" just like with anti-virus software.