Difference between a behaviour-based security and traditional firewall? As I have searched the web and honestly cannot find anything about it.
A traditional firewall allows or denies something based on the rules you defined. Any traffic passing through there will be filtered by the rules. If you want to change something (to adapt to a new threat) you will have to alter your rules.
Behavior-based security systems are designed to 'learn' what patters of usage you have in our network. After a while, they determine how traffic behaves overall and make automatically some general rules to allow those learned patters. If something unusual appears in the network, there will be triggered alerts or denial of traffic depending on the configuration. For example, if the system finds that your average user sends 50 e-mail per day, it makes a rule for that. If a user suddenly sends 500 instead, it will be blocked or signaled as suspect.