Detecting network intrusions via a statistical analysis of network packet characteristics

Abstract

Absrracf-With the growing threat of abuse of network resources, it becomes increasingly important to be able to detect malformed packets on a network and estimate the damage they ean cause. Carefully constructed, certain types of packets can cause a victim host to crash while other packets may be sent only to gather necessary information about hosts and networks and can be viewed as a prelude to attack. In this paper, we collect and analyze aU of the IP and TCP packets seen on a network that either violate existing standards or should not appear in modem intemets. Our goal is to determine what these suspiaous packets mean and evaluatewhat proportion of such packets can cause actual damage. Thus, we divide u n d packets obtained dnring our experiments into several categories depending on the severity of their consequences, ineluding indireet consequences as a result of information gathering, and show the d t s . The traces analyzed were gathered at Ohio University's main Internet link, providing a massive amount of statistical data

Anomaly detection methods in wired networks: a survey and taxonomy

“…For instance, in Ref. [27] Bykova et al identify several categories of malformations observed in TCP/IP packets that include:…”

Predicting Violations of QoS Requirements in Distributed Systems

“…Much of the work in this area models normal network behaviour so that behaviour that does not satisfy the constraints of normal network behaviour is assumed to be caused by intrusion. Examples of this work include [1].…”

“…We developed a QoS management system [6] that deals with soft and dynamic QoS requirements by providing management services (implemented by a set of management processes and resource managers that support the following: (1) Detecting that an application's run-time behaviour does not satisfy the application's QoS requirements. This violation of QoS requirements (also called a symptom) is a manifestation of a fault in the system.…”

A Discriminant Model of Network Anomaly Behavior Based on Fuzzy Temporal Inference

“…Up till now the basic idea of network anomaly discriminant lies in anomaly detection method, provided by Denning in 1987 [1]. That is to say, according to abnormality situations of audit statement in monitoring system, the bad behaviors (i.e.…”