Bro IDS script to detected XOR'd binaries