... categories of intrusion detection systems: network- WATSON et al.: PROTOCOL SCRUBBING: NETWORK SECURITY THROUGH TRANSPARENT FLOW MODIFICATION 263based and host-based. Network- based intrusion detection ... events,WATSON et al.: PROTOCOL SCRUBBING: NETWORK SECURITY THROUGH TRANSPARENT FLOW MODIFICATION 265estimating round-trip time, calculating window sizes, etc.—foreach network flow restricts performance ... http://www.insecure.org/nmap/nmap-fingerprinting-article.htmlWATSON et al.: PROTOCOL SCRUBBING: NETWORK SECURITY THROUGH TRANSPARENT FLOW MODIFICATION 273[4] T. H. Ptacek and T. N. Newsham, “Insertion, evasion, and denial of ser-vice: Eluding network intrusion...