I have a question using Zeek (Bro) Index. I am trying to learn about the index "Weird". It seems like it would be difficult to some extend to identify "weird" traffic. Does it compare it against a baseline? Also, what is a malformed connection. I would like to know more about that and the specifics of fit.