  An approach for real-time network monitoring in terms of numerical
time-dependant functions of protocol parameters is suggested. Applying complex
systems theory for information f{l}ow analysis of networks, the information
traffic is described as a trajectory in multi-dimensional parameter-time space
with about 10-12 dimensions. The network traffic description is synthesized by
applying methods of theoretical physics and complex systems theory, to provide
a robust approach for network monitoring that detects known intrusions, and
supports developing real systems for detection of unknown intrusions. The
methods of data analysis and pattern recognition presented are the basis of a
technology study for an automatic intrusion detection system that detects the
attack in the reconnaissance stage.
