An immune approach for anomaly detection from network traffic at the application level

Buffer overflow attacks are one of the most important attack classes because they enable an attacker to remotely execute arbitrary code at the target host. These attacks generaly disturb the network traffic at the application level by delivering anomalous data to the target applications. This work presents a prototype to detect anomalous network traffic containing executable code at the application level. This prototype is inspired by the negative selection process performed by T lymphocytes in the human immune system. A case study with the DNS protocol demonstrates that this can be a very promising approach.