A comprehensive survey on network anomaly detection

Fernandes, Gilberto; Rodrigues, Joel J. P. C.; Carvalho, Luiz F.; Al‐Muhtadi, Jalal; Proença, Mário Lemes

doi:10.1007/s11235-018-0475-8

Cited by 245 publications

(154 citation statements)

References 140 publications

Supporting

Mentioning

110

Contrasting

Unclassified

Order By: Relevance

“…The detection phase is done by the implementation of the entropy algorithm, which analyzes the data obtained in the monitoring phase, and can detect malicious flows. Compared with other tools based on patterns [32], statistical algorithms like the entropy calculation do not require a big amount of memory or storage. This transforms these approaches in a suitable solution for its inclusion into the SDN network elements.…”

Section: Detectionmentioning

confidence: 99%

Detection and Mitigation of DoS and DDoS Attacks in IoT-Based Stateful SDN: An Experimental Approach

Galeano-Brajones

Carmona-Murillo

Valenzuela-Valdés

et al. 2020

Sensors

105

View full text Add to dashboard Cite

The expected advent of the Internet of Things (IoT) has triggered a large demand of embedded devices, which envisions the autonomous interaction of sensors and actuators while offering all sort of smart services. However, these IoT devices are limited in computation, storage, and network capacity, which makes them easy to hack and compromise. To achieve secure development of IoT, it is necessary to engineer scalable security solutions optimized for the IoT ecosystem. To this end, Software Defined Networking (SDN) is a promising paradigm that serves as a pillar in the fifth generation of mobile systems (5G) that could help to detect and mitigate Denial of Service (DoS) and Distributed DoS (DDoS) threats. In this work, we propose to experimentally evaluate an entropy-based solution to detect and mitigate DoS and DDoS attacks in IoT scenarios using a stateful SDN data plane. The obtained results demonstrate for the first time the effectiveness of this technique targeting real IoT data traffic.

show abstract

Section: Detectionmentioning

confidence: 99%

Detection and Mitigation of DoS and DDoS Attacks in IoT-Based Stateful SDN: An Experimental Approach

Galeano-Brajones

Carmona-Murillo

Valenzuela-Valdés

et al. 2020

Sensors

105

View full text Add to dashboard Cite

show abstract

“…An effective program should provide a means of providing explanations to what patterns are being displayed. Compared with command line tools that can pipe data to other applications, visualizations are usually standalone programs (Fernandes et al, 2019). When visualizations support only a specific data format, it is difficult to work with these programs in conjunction with other analytic tools.…”

Section: Cybersecurity Visualizationsmentioning

confidence: 99%

A Service Architecture Using Machine Learning to Contextualize Anomaly Detection

Laughlin

Sankaranarayanan

El-Khatib

2020

Journal of Database Management

View full text Add to dashboard Cite

This article introduces a service that helps provide context and an explanation for the outlier score given to any network flow record selected by the analyst. The authors propose a service architecture for the delivery of contextual information related to network flow records. The service constructs a set of contexts for the record using features including the host addresses, the application in use and the time of the event. For each context the service will find the nearest neighbors of the record, analyze the feature distributions and run the set through an ensemble of unsupervised outlier detection algorithms. By viewing the records in shifting perspectives one can get a better understanding as to which ways the record can be considered an anomaly. To take advantage of the power of visualizations the authors demonstrate an example implementation of the proposed service architecture using a linked visualization dashboard that can be used to compare the outputs.

show abstract

“…The other field of which we describe related work is traffic anomaly detection . Anomaly detection usually consists of two phases: the learning phase and a testing phase.…”

Section: Related Workmentioning

confidence: 99%

BackStreamDB: A stream processing engine for backbone traffic monitoring with anomaly detection

Duarte

Hara

Torres

et al. 2020

Security and Privacy

View full text Add to dashboard Cite

BackStreamDB is distributed traffic monitoring system based on a stream processing engine (SPE) designed to monitor the traffic of wide area backbones.BackStreamDB provides arbitrary metrics about the traffic in real time, taking into account the backbone as a whole. The system was developed for and successfully deployed on the Brazilian National Academic Network (RNP). In this work, we describe the functionality for the detection of traffic anomalies. A large number of Internet attacks are continuously reported, and several types of attacks result in anomalous traffic. In the proposed strategy for anomaly detection, the traffic is sampled by monitors that are distributed across the backbone, which are accessed and processed by the SPE. BackStreamDB was extended with stream processing modules for computing traffic entropy and principal component analysis, which are the employed to detect traffic anomalies. Experimental results are reported which were obtained to validate the effectiveness of the proposed strategy for different types of attacks.

show abstract

A comprehensive survey on network anomaly detection

Cited by 245 publications

References 140 publications

Detection and Mitigation of DoS and DDoS Attacks in IoT-Based Stateful SDN: An Experimental Approach

Detection and Mitigation of DoS and DDoS Attacks in IoT-Based Stateful SDN: An Experimental Approach

A Service Architecture Using Machine Learning to Contextualize Anomaly Detection

BackStreamDB: A stream processing engine for backbone traffic monitoring with anomaly detection

Contact Info

Product

Resources

About