resource loop anomaly detection, reserved msdos fields anomaly detection