detecting novel attacks by identifying anomalous network packet headers .
Experience with EMERALD to Date