Abstract: Most of the network anomaly detection approaches are based on packet header fields,while the payload is usually discarded, namely they detect network attacks only from network layer and transport layer. Unfortunately, most of today＇s attacks happen on the

Key words: Application level, Anomaly detection, Network security