I’m afraid the exact explanation of the Behavior Shield changes would be rather technical (and I don’t know myself what’s changed) - but generally, new versions are able to monitor more events than the older ones, or to better connect those events to one another (i.e. to follow the chain of actions and track the real offender).