Real time network anomaly detection using relative entropy

As the computer networks continue to increase in size, complexity and importance, the network security issue becomes more and more important. In this paper, we propose a real time anomaly detection system based on relative entropy. The proposed system captures the network traffic packets and then uses relative entropy and adaptive filter to dynamically determine the traffic changes and to examine whether the traffic change is normal or contains anomaly. Our experimental results show that the proposed system is efficient for on-line anomaly detection, using traffic trace collected in high-speed links.