Network Intrusion Detection: Using MDLcompress for deep packet inspection
E. Earl Eiland, Scott C. Evans, T. Stephen Markham, Bruce Barnett, Jeremy Impson, Eric Steinbrecher · 2008
We apply MDLcompress, a grammar inference engine, to Network Intrusion Detection (NID). We specifically target HTTP payload analysis of Deep Packet Inspection (DPI) utilizing the DARPA 1999 data sets for our normal network traffic base and create modern attack traffic using Nessus. Our approach accurately detected over 98% of the attacks compared with literature reports of approximately 95% accuracy rate on HTTP attacks.