Based on the natural complexity in characterizing the normal network performance, the difficulty of anomaly detection may be categorized as model based and non- model based. According to model based anomaly detectors, it is assumed that an identified model is accessible for the normal behaviour of definite specific aspects of the network and any divergence from the norm is supposed an anomaly. Network behaviours that cannot be characterized by any model for such condition non-model based approaches are used.