Multilayer packet tagging for network behaviour analysis

Network behaviour analysis (NBA) is a system that analyses the network data stream or packets characteristics. NBA commonly associated with network intrusion detection and prevention system (IDS/IPS), as the mechanism used in NBA is well known for its capability to discover the hidden information in network packets. Among popular methods empowered the NBA is misuse detection and anomaly detection techniques. Misuse detection is suitable for known attacks that already have list of actions to be taken based on historical events from past attacks. However, misuse detection is inefficient to deal with zero-day type of attack. This paper describes the concept of multilayer packet tagging approach that is possible to compliment the weaknesses found in misuse detection techniques in NBA system.