Protocol anomaly detection and verification

´How to distinguish protocol anomalies from network traffic?´ ´How to normalize protocol usage against misuse problem based on the same protocol specification?´ and ´How to detect and verify protocol anomalies in realtime?´, we seek to answer these questions. In order to solve these questions, we have normalized layer-3 and layer-4 protocol usage, and we have designed a packet verifier with a packet inspection engine and a SanityChecker. In this work, we specify TCP transaction behaviours declaratively in a high-level language called Specification and Description Language (SDL). This specification is compiled into an inspection engine program for observing packets. In addition, the SanityChecker covers protocol header anomalies.