Protocol anomaly detection based on string kernels

Kernels defined on vectors have been widely used in host-based intrusion detection. We propose a protocol anomaly detection model based on string kernels including high-order Markov kernel, all-length gap-weighted kernel, all-length-weighted kernel and its variation all-length-weighted once kernel. Experimental results show that these string kernels can hold state information of protocols well. Models proposed achieve a high detection rate.