Incorporation of application layer protocol syntax into anomaly detection
Learning nonstationary models of normal network traffic for detecting novel attacks