Suricata

This is an interesting paper:

“Flow Size Difference” Can Make a Difference: Detecting Malicious TCP Network Flows Based on Benford’s Law

http://arxiv.org/pdf/1609.04214v1.pdf