A protocol anomaly detection model based on Hidden Markov Model (HMM) is given in this work which can verify normal and abnormal traffic. Then we demonstrate the model's correctness and effectiveness by using MIT Lincoln Laboratory 1999 DARPA Intrusion Detection Evaluation Data Set.
['Jing Zhao', 'Houkuan Huang', 'Shengfeng Tian', 'Xiang Zhao']
Applications of HMM in Protocol Anomaly Detection