Figure 3 - Defining new signatures

T D A S 10 20 80 WEB:CGI-PHF get/20/2fcgi-bin/2fphf

| | | | |  |  |  |           |

| | | | |  |  |  |           |

| | | | |  |  |  |           SEARCH STRING

| | | | |  |  |  EVENT NAME

| | | | |  |  |

| | | | |  |  PORT

| | | | |  |

| | | | |  COMPARE BYTES

| | | | |

| | | | DYNAMIC LOG

| | | |

| | | BINARY OR STRING

| | |

| | PROTECTED NETWORKS

| |

| DIRECTION

|

PROTOCOL