than monitoringwhat applications are running; they also need to know when human intruders ormalware have compromised the security of their systems. Intrusion detectionsystems are most commonly built upon elaborate rule databases that specify thesignatures associated with known attacks [21] or specifications of whatnetwork activity is and is not allowed [18]. One fundamental problem for allsuch systems, though, is that disruptive network activity often is caused notby attackers but by highly popular legitimate applications or services (e.g.,flash crowds). Either the rules have to be broad enough to not signal alarmsin some disruptive conditions, or administrators have to tolerate a regularstream of false alarms. Anomaly detection systems have the potential to adjust rules to localconditions through the use of machine learning mechanisms; behavior at thenetwork layer, however, is highly dynamic, and in fact attempted attacks arenow routine on the Internet. For these reasons, some researchers are coming tobelieve that anomaly detection at the network layer is a questionable strategyfor detecting security incidents [9]; such reasoning, however, does notexclude the use of anomaly detection for detecting networking problems ingeneral [1]. While these various techniques for monitoring and classifying networkbehavior have their place, there is also a need for tools that can uncoverother aspects of the structure of network traffic. The next section exploreswhat is missing in currently available tools. Understanding Network Traffic To understand network behavior we need to observe more than changes inpacket volume or security status. In addition, we need to discern patterns intraffic that allow us to group related communication activities together.While we cannot hope to find all possible patterns, there are a number of waysto capture simple patterns in network traffic. The general strategy forgrouping packets together using automatically learned patterns (or features)is to employ a clustering-based machine learning algorithm. One strategy for clustering packets is to learn patterns associated withsets of flows. For example, AutoFocus [7] is a system that hierarchicallyclusters packets using IP address and port information so that temporalpatterns in the activities of groups of hosts can be inferred. However, thereare many interesting patterns which cannot be defined in terms of protocol andaddress. Ma, et al. [14] addressed this limitation by building classifiersfrom network flows using the header and first 64 bytes of payload from theinitial packet in each flow. Their classifiers were built using clusterers.Clusterers don't label data, they simply group it together. Once a clustererwas constructed, the packets in each cluster were examined and assigned to aparticular protocol, turning the clusterer into a classifier. Although, Ma'sapproach is promising, it is not fast enough to be used to monitor networksonline. In fact, most general clustering and classification algorithms aresimply too slow to learn at wire speed. This limitation is significant becausewe want to observe changes in behavior as they happen so that we may react tochanges in a timely fashion. NetADHICT differentiates itself from other traffic clustering tools inthat NetADHICT clusters traffic without knowing in advance any details aboutthe packets' structure and does so in a way that can execute at the speed ofthe network. This allows it to find its own differences between the packets -differences