Network Intrusion Detection: Using MDLcompress for deep packet inspection

We apply MDL compress, a grammar inference engine, to network intrusion detection (NID). We specifically target HTTP payload analysis of deep packet inspection (DPI) utilizing the DARPA 1999 data sets for our normal network traffic base and create modern attack traffic using Nessus. Our approach accurately detected over 98% of the attacks compared with literature reports of approximately 95% accuracy rate on HTTP attacks.