A BasisEvolution framework for network traffic anomaly detection

Xia, Hui; Fang, Bin; Roughan, Matthew; Cho, Kenjiro; Tune, Paul

doi:10.1016/j.comnet.2018.01.025

Cited by 17 publications

(13 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The PCA techniques based in Lakhina's work [6,12,[17][18][19][20]] are more complete, in the sense that they consider steps 1 to 4. Still, the diagnosing method is limited in those methods and improved in MSNM [47,48].…”

Section: De-parsingmentioning

confidence: 99%

Multivariate Big Data Analysis for intrusion detection: 5 steps from the haystack to the needle

Camacho

García-Giménez

Fuentes‐García

et al. 2019

Computers & Security

View full text Add to dashboard Cite

The research literature on cybersecurity incident detection & response is very rich in automatic detection methodologies, in particular those based on the anomaly detection paradigm. However, very little attention has been devoted to the diagnosis ability of the methods, aimed to provide useful information on the causes of a given detected anomaly. This information is of utmost importance for the security team to reduce the time from detection to response. In this paper, we present Multivariate Big Data Analysis (MBDA), a complete intrusion detection approach based on 5 steps to effectively handle massive amounts of disparate data sources. The approach has been designed to deal with the main characteristics of Big Data, that is, the high volume, velocity and variety. The core of the approach is the Multivariate Statistical Network Monitoring (MSNM) technique proposed in a recent paper. Unlike in state of the art machine learning methodologies applied to the intrusion detection problem, when an anomaly is identified in MBDA the output of the system includes the detail of the logs of raw information associated to this anomaly, so that the security team can use this information to elucidate its root causes. MBDA is based in two open software packages available in Github: the MEDA Toolbox and the FCParser. We illustrate our approach with two case studies. The first one demonstrates the application of MBDA to semistructured sources of information, using the data from the VAST 2012 mini challenge 2. This complete case study is supplied in a virtual machine available for download. In the second case study we show the Big Data capabilities of the approach in data collected from a real network with labeled attacks.

show abstract

Section: De-parsingmentioning

confidence: 99%

Multivariate Big Data Analysis for intrusion detection: 5 steps from the haystack to the needle

Camacho

García-Giménez

Fuentes‐García

et al. 2019

Computers & Security

View full text Add to dashboard Cite

show abstract

“…Also, DDoS detection using MP and Orthogonal Matching Pursuit (OMP) algorithms is proposed in [15]. The OMP algorithm, principal component analysis, robust principal component analysis, and backpropagation neural network methods are used for DDoS detection in [18].…”

Section: Related Workmentioning

confidence: 99%

“…Residuals obtained fromMPis used as detection scores [18] PCA, OMP, ANN, Synthetic Traffic Data, Janepese SIP real data.…”

Section: Related Workmentioning

confidence: 99%

“…As we mentioned before, we use ANN in the decision module. In the case of MPMP and Wavelet approaches, similar to the AMP method, the framework calculates abnormality values defined in Equations (16) and (18) and generate alarms using them with decision module.…”

Section: ) Hybrid Detection Framework Training and Alarm Generationmentioning

confidence: 99%

“…Similarly, for Wavelet, the energy difference En between the different layers of attribute vectors, shown in the equation (18) are used to train the ANN network.…”

Section: ) Hybrid Detection Framework Training and Alarm Generationmentioning

confidence: 99%

See 2 more Smart Citations

Hybrid DDoS Detection Framework Using Matching Pursuit Algorithm

Erhan

Anarım

2020

IEEE Access

View full text Add to dashboard Cite

Although a considerable amount of research has been done on DDoS attacks, it still poses a severe threat to many businesses and internet service providers. DDoS attacks commonly generate a high amount of network traffic. However, the resource depletion DDoS attacks can deny the target service, although it generates much less traffic than legitimate traffic. We propose a novel DDoS detection framework using the Matching Pursuit algorithm to detect resource depletion type DDoS attacks. We use multiple characteristics of network traffic simultaneously in order to detect low-density DDoS attacks efficiently. The proposed method uses the dictionary produced from the parameters of the network traffic using the K-SVD algorithm. Dictionary generation using network traffic, provides legitimate and attack traffic models, and adds adaptability of the proposed method to network traffic. We also implement DDoS detection approaches that use Matching Pursuit and Wavelet techniques and compare them using two different data sets. Additionally, we offer a hybrid DDoS detection framework that combines these approaches with a decision-making mechanism using an artificial neural network. We evaluate the proposed methods with two different data sets. The proposed approaches perform over 99% true positive rate with a false positive rate lower than 0.7% with a low-density DDoS attack dataset. In the hybrid intrusion detection system with more than one attack, the detection performances of other methods have decreased, while the proposed approach achieves true positive rates higher than 99% with a false positive rate lower than 0.7%.

show abstract

Ternary-based feature level extraction for anomaly detection in semantic graphs: an optimal feature selection basis

Reddy

Rajput

2021

Sādhanā

View full text Add to dashboard Cite

A BasisEvolution framework for network traffic anomaly detection

Cited by 17 publications

References 19 publications

Multivariate Big Data Analysis for intrusion detection: 5 steps from the haystack to the needle

Multivariate Big Data Analysis for intrusion detection: 5 steps from the haystack to the needle

Hybrid DDoS Detection Framework Using Matching Pursuit Algorithm

Ternary-based feature level extraction for anomaly detection in semantic graphs: an optimal feature selection basis

Contact Info

Product

Resources

About