ARIMA Based Network Anomaly Detection

Yaacob, Asrul H.; Tan, Ian K. T.; Chien, Su Fong; Tan, Hon Khi

doi:10.1109/iccsn.2010.55

Cited by 109 publications

(35 citation statements)

References 3 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Other sources such as Jelen [21] underline that measurements as being taken by metrics are a critical point and that a metric should not rely on an isolated measurement. Furthermore, stochastic approaches have been successfully applied on threat intelligence data to address uncertainties in the data (e.g., [29,39,41]). Accordingly, we base our method on research and best practices of metrics.…”

Section: Overview Of Security Metricsmentioning

confidence: 99%

ARIMA Supplemented Security Metrics for Quality Assurance and Situational Awareness

Kohlrausch¹,

Brin²

2020

Digital Threats

View full text Add to dashboard Cite

Quality assurance and situational awareness are important areas of interest for CSIRTs and security teams. Significant efforts have been made on defining metrics measuring critical parameters for these fields of application. However, methodical approaches are missing or lacking precision to enable a reliable usage of such metrics for quality assurance and situational awareness. In this contribution, we introduce a method that generalizes the application of ARIMA time series analysis on a welldefined set of metrics (ARIMA supplemented metrics) to facilitate and support quality assurance and situational awareness services. This method is based on research on ARIMA models and metrics and builds on CSIRT best practices. We show how data analysts and security practitioners can incorporate this method into existing best practices for CSIRT services pertaining to quality assurance and situational awareness. The applicability of this method is demonstrated by integrating ARIMA supplemented metrics into exemplary processes for quality assurance and situational awareness to support data analysts and security practitioners in CSIRTs and security teams. CCS Concepts: • Security and privacy → Malware and its mitigation; Intrusion detection systems; • Mathematics of computing → Time series analysis; Exploratory data analysis; Stochastic processes; • Security and privacy → Denial-of-service attacks; Formal security models;

show abstract

Section: Overview Of Security Metricsmentioning

confidence: 99%

ARIMA Supplemented Security Metrics for Quality Assurance and Situational Awareness

Kohlrausch¹,

Brin²

2020

Digital Threats

View full text Add to dashboard Cite

show abstract

“…A summary of the related work is listed in Table 1. There are reviews addressing the chal- Scientific Work Reviews [19,27] Graph-based methods [2,12,13,36,37,41,42] Graph-based and time-sensitive methods [1,45] Machine learning-based [6,14,32] Statistical processes [33,44,48,50] Wavelet analysis [25,31,35] Industrial Intrusion Detection [3,15,18,20,23,28,34,38,39,46] lenge of anomaly detection for intrusion detection. García-Teodoro et al address the challenges of this field of work while presenting techniques and systems [19].…”

Section: Related Workmentioning

confidence: 99%

“…Consequently, an anomaly is detected if the observed behaviour does not match the modeled values. A common approach is using Auto-Regressive Integrated Moving Average (ARIMA) to model time series behaviour [33,48], Tabatabaie et al include a chaotic behaviour prediction into their ARIMA model [44]. Yu et al present an anomaly detection scheme based on ARIMA for Wireless Sensor Networkss (WSNs) [50].…”

Section: Related Workmentioning

confidence: 99%

Using Temporal and Topological Features for Intrusion Detection in Operational Networks

Antón¹,

Fraunholz²,

Schotten³

2019

Proceedings of the 14th International Conference on Availability, Reliability and Security

View full text Add to dashboard Cite

Until two decades ago, industrial networks were deemed secure due to physical separation from public networks. An abundance of successful attacks proved that assumption wrong. Intrusion detection solutions for industrial application need to meet certain requirements that differ from home-and office-environments, such as working without feedback to the process and compatibility with legacy systems. Industrial systems are commonly used for several decades, updates are often difficult and expensive. Furthermore, most industrial protocols do not have inherent authentication or encryption mechanisms, allowing for easy lateral movement of an intruder once the perimeter is breached. In this work, an algorithm for motif discovery in time series, Matrix Profiles, is used to detect outliers in the timing behaviour of an industrial process. This process was monitored in an experimental environment, containing ground truth labels after attacks were performed. Furthermore, the graph representations of a different industrial data set that has been emulated are used to detect malicious activities. These activities can be derived from anomalous communication patterns, represented as edges in the graph. Finally, an integration concept for both methods is proposed.• Security and privacy → Intrusion detection systems; Network security; • Theory of computation → Design and analysis of algorithms; • Applied computing → Enterprise architectures.

show abstract

“…For instance, it can be used as a tool for extracting the baseline of network traffic to capture the underlying traffic trend [4] and facilitate techniques such as traffic shaping for improved Quality of Service [5]. Moreover, it allows the detection of anomalies by blending network traffic forecasts with tolerable operational thresholds [6]. The method proposed in this paper is designed to facilitate security and monitoring services at the lower end of the infrastructure.…”

Section: Introductionmentioning

confidence: 98%

Predicting Traffic in the Cloud: A Statistical Approach

Dalmazo

Vilela

Curado

2013

2013 International Conference on Cloud and Green Computing

View full text Add to dashboard Cite

Monitoring and managing traffic are vital elements to the operation of a network. Traffic prediction is an essential tool that captures the underlying behavior of a network and can be used, for example, to detect anomalies by defining acceptable data traffic thresholds. In this context, most current solutions are heavily based on historical time data, which makes it difficult to employ them in a dynamic environment such as cloud computing. We propose a traffic prediction approach based on a statistical model where observations are weighted with a Poisson distribution inside a sliding window. The evaluation of the proposed method is performed by assessing the Normalized Mean Square Error of predicted values over observed values from a real cloud computing dataset, collected by monitoring the utilization of Dropbox. Compared with other predictors, our solution exhibits the strongest correlation level and shows a close match with real observations.

show abstract

ARIMA Based Network Anomaly Detection

Cited by 109 publications

References 3 publications

ARIMA Supplemented Security Metrics for Quality Assurance and Situational Awareness

ARIMA Supplemented Security Metrics for Quality Assurance and Situational Awareness

Using Temporal and Topological Features for Intrusion Detection in Operational Networks

Predicting Traffic in the Cloud: A Statistical Approach

Contact Info

Product

Resources

About