Network security through conservation of complexity

The problem of network security is approached from the point of view of Kolmogorov complexity (see Evans. S, et al., Proc. DARPA Inf. Survivability Conf. & Exposition II, vol 2. p.322-33, 2001). The principle of conservation of complexity is utilized to identify healthy complexity norms objectively and detect attacks via deviation of these norms under TCP/IP. Observed complexity changes that fall within expected hounds are indicators of system health, while complexity changes outside the expected bounds for normal protocol and application use are indicators of system fault or attack. Experimental results using FTP normal and attack sessions are presented.