DocumentCode :
647494
Title :
A hybrid approach for anomaly detection on large-scale networks using HWDS and entropy
Author :
de Assis, Marcos V. O. ; Rodrigues, Joel J. P. C. ; Lemes Proenca, Mario
Author_Institution :
Comput. Sci. Dept., State Univ. of Londrina, Londrina, Brazil
fYear :
2013
fDate :
18-20 Sept. 2013
Firstpage :
1
Lastpage :
5
Abstract :
The constant growth in scale and complexity of computer networks in recent years has led to the need for more powerful anomaly detection tools and approaches. Several researches have been developed in this area, focusing on the detection of volume anomalies through the analysis of quantitative flow features, like bits or packages per second. This paper presents a hybrid approach of anomaly detection based on the traffic characterization of four qualitative flow features using the Shannon entropy: IP addresses and ports of origin and destination. In order to achieve a traffic characterization of the four analyzed dimensions, we use the Holt-Winters for Digital Signature (HWDS) method. It is an improvement of the traditional method which is able to efficiently characterize the traffic, generating a Digital Signature of Network Segment using Flow analysis (DSNSF) for each dimension. The presented approach is tested using real data collected at the State University of Londrina - Brazil aiming to determine the performance outcomes of the approach in both traffic characterization and anomaly detection processes.
Keywords :
computer network security; digital signatures; information theory; telecommunication traffic; DSNSF; HWDS; HWDS method; Holt-winters for digital signature; IP addresses; Shannon entropy; anomaly detection tools; computer networks; digital signature of network segment using flow analysis; hybrid approach; large-scale networks; traffic characterization; volume anomalies; Anomaly Detection; DSNSF; Entropy; HWDS; Traffic Characterization;
fLanguage :
English
Publisher :
ieee
Conference_Titel :
Software, Telecommunications and Computer Networks (SoftCOM), 2013 21st International Conference on
Conference_Location :
Primosten
Type :
conf
DOI :
10.1109/SoftCOM.2013.6671845
Filename :
6671845
Link To Document :
بازگشت