In reply to Bruce Rosenthal.

Hi Bruce,

this approach comes from Cognitive Threat Analytics (CTA, see link), not from Talos/Snort group. The difference is that the breach detection systems work by performing statistical analysis on large volumes of data. This allows them to discover novel threats and threat categories that are difficult to spot using in-line IDS/IPS.