## 2 Approach and Improvements
### Mapping Text Messages into Feature Space  
Feature extraction has to be performed in a way that leads to a good classification result with a reasonable effort and complexity. Starting point for the definition of the features is the idea of using n-grams as proposed by [PERSON] _et al._[4]. The authors created a set of n-grams from the training data. The number of different n-grams gives the dimension of the feature space and the occurrence of the n-gram is the associated value. In [4], best performance for SIP messages was achieved with n-gram size \(n=4\), which is also adopted for the work presented here. Inspired by the idea of using tokens in addition to n-grams [4], we complement the n-grams by special keywords. In contrast to the token idea, our keywords are not determined ad hoc but are predefined based on protocol standards. These keywords are neither limited to a number of occurrences inside the SIP message nor to the associated value. Whenever one of these keywords is recognized during feature extraction, a specific _keyword action_ is triggered. Three different keyword actions proved useful:  
* Keyword action _Counting_. The detection of some protocol-specific tokens contributes more valuable information than the corresponding n-gram combination. For example, a non-standard number of occurrences can be seen as a direct indication of message anomaly. Therefore, we  
Figure 1: Classifier-based anomaly detection system with training and execution phase. include additional features consisting of protocol-specific keywords and the corresponding number of occurrence in the SIP message. An example is given in Figure 2, where _Via_ is chosen as a keyword with keyword action _Counting_. In this example, the value associated with feature _kVia_ is two, given that it occurs twice in the message. * Keyword action _Value extraction_. In some cases, not the number of occurrence of a keyword, but the message contents associated with a keyword are relevant for classification. Therefore, keyword action _Value extraction_ includes additional features consisting of the protocol-specific keyword and a value, which is either a keyword-dependent value that directly occurs in the message, or the result of a regular expression over the message contents following this keyword. An example is given in Figure 2 for the _Content-Length_ keyword. The feature vector contains the feature _kContent-Length_ with value 0, which is the content length value found in the original message. * Keyword action _Message modification_. Inside the SIP message are parts, which can be interpreted only within the context of the conversation. Given that we do not keep state information about ongoing conversations, we cannot interpret these parts and considering them leads more or less to distracting noise. To avoid producing useless features from these parts of a message, the value can be ignored, replaced with default values, or even be removed completely before n-grams are generated. Before performing such actions, however, local checks of the keyword value are performed to cover anomalies in this part of the message. If this local check fails the message can be directly marked as invalid. Figure 2 shows on the right hand side how this keyword action is used with the _branch_ keyword. From the SIP standard [1] we take the knowledge that the _branch_ value must be globally unique per user agent, has the defined prefix _z9 hG4 bK_, must only contain characters from a predefined set, and has no length restriction. Thus, when using 4-grams only, we observed that the value of this field adds a high number of n-grams, which are basically useless noise, and can hardly be reduced in the attribute reduction step. Therefore, we remove the value which belongs to _branch_ after we performed a syntactic check based on the characters allowed. Figure 2 illustrates this keyword action: the _branch_ value of the first _Via_ line is removed, while the branch value of the second _Via_ line does not pass the syntax check.