A sophisticated software and appliance based network intrusion defense system, the Dragon Network Sensor identifies misuse and attacks across the network. Placed at network aggregation points, the Dragon Network Sensor is unmatched in detecting security events such as network misuse, network intrusions, system exploits and virus propagations via signature, protocol, and anomaly-based techniques. Application-based event detection detects non-signature-based attacks against commonly targeted applications including HTTP, RPC and FTP. Dragon's Adaptive Match Engine analyzes the profile of network traffic flowing through the sensor and then "adaptively" select one of nine algorithms with which to analyze the traffic. In this way, the Sensor can use multiple detection algorithms simultaneously while intelligently applying each to the type of traffic it is best suited to analyze. Additionally, the signature-based pattern matching engine is capable of detecting Zero Day events through adaptive signatures, which allow Dragon to detect an unknown threat by matching its characteristics to the characteristics of similar known threats. These multimethod detection techniques - combined with an extensive, frequently updated signature database and false positive tuning capabilities - ensure that no threat and policy violations goes undetected.