Incorporation of application layer protocol syntax into anomaly detection
Snort - Lightweight Intrusion Detection for Networks