What is Protocol Anomaly Detection?
The ability to analyze traffic on the network and perform packet decode and protocol analysis to determine what constitutes a protocol anomaly. Applied to an IDS, Protocol Anomaly Detection is needed to determine what packets are illegal or ambiguous, when checked against the RFCs or definitions imposed by the network administrator, and may constitute security threats. The reason Protocol Anomaly Detection works is that under normal conditions, system and network devices do not tend to create illegal or ambiguous traffic. Attackers create illegal or ambiguous traffic to try to evade an IDS that uses Signature-Based Detection methods.
