Re: protocol method

[Christian Kreibich <christian () whoop org>]

On Tue, 2003-06-24 at 03:58, sickle wrote:
> I'm looking for a paer about detecting through protocol method than 
> pattern matching.Does anyone has an idea where can i get it?

I'm not 100% sure if I understand the question, but this may help:
http://www.icir.org/vern/papers/norm-usenix-sec-01-html/

Or as a postscript:
http://www.cl.cam.ac.uk/~cpk25/publications/norm.ps.gz

Regards,
Christian.
-- 
________________________________________________________________________
                                                    http://www.whoop.org


-------------------------------------------------------------------------------
Attend the Black Hat Briefings & Training, July 28 - 31 in Las Vegas, the 
world's premier technical IT security event! 10 tracks, 15 training sessions, 
1,800 delegates from 30 nations including all of the top experts, from CSO's to 
"underground" security specialists.  See for yourself what the buzz is about!  
Early-bird registration ends July 3.  This event will sell out. www.blackhat.com
-------------------------------------------------------------------------------