Entropy-based profiling of network traffic for detection of security attack

Network security has become a major concern in recent years. In this research, we present an entropy-based network traffic profiling scheme for detecting security attacks. The proposed scheme consists of two stages. The purpose of the first stage is to systematically construct the probability distribution of relative uncertainty for normal network traffic behavior. In the second stage, we use the chi-square goodness-of-fit test, a calculation that measures the level of difference of two probability distributions, to detect abnormal network activities. The probability distribution of the relative uncertainty for short-term network behavior is compared with that of the long-term profile constructed in the first stage. We demonstrate the performance of our proposed scheme for DoS attacks with the dataset derived from KDD CUP 1999. Experimental results show that our proposed scheme achieves high accuracy if the features are selected appropriately.