duphead anomaly detection, virtual header mapping