A syntactic approach for identifying multi-protocol attacks