Protocol anomaly detection and verification
InSeon Yoo · 2005
'How to distinguish protocol anomalies from network traffic?' 'How to normalize protocol usage against misuse problem based on the same protocol specification?' and 'How to detect and verify protocol anomalies in realtime?', we seek to answer these questions. In order to solve these questions, we have normalized layer-3 and layer-4 protocol usage, and we have designed a packet verifier with a packet inspection engine and a SanityChecker. In this work, we specify TCP transaction behaviours declaratively in a high-level language called Specification and Description Language (SDL). This specification is compiled into an inspection engine program for observing packets. In addition, the SanityChecker covers protocol header anomalies.