PCA Tail as the Anomaly Indicator

Škvarek, Ondrej; Klimo, Martin; Kopcan, Jaroslav

doi:10.1109/iceta51985.2020.9379267

Cited by 3 publications

(2 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…An effective method for detection is also Principal Component Analysis (PCA). In [29], PCA is used to indicate anomalies. In [30], PCA is used for dimensionality reduction of the IP flow dataset attributes.…”

Section: Related Workmentioning

confidence: 99%

Machine Recognition of DDoS Attacks Using Statistical Parameters

Smiesko,

Segec,

Kontsek

2023

Mathematics

View full text Add to dashboard Cite

As part of the research in the recently ended project SANET II, we were trying to create a new machine-learning system without a teacher. This system was designed to recognize DDoS attacks in real time, based on adaptation to real-time arbitrary traffic and with the ability to be embedded into the hardware implementation of network probes. The reason for considering this goal was our hands-on experience with the high-speed SANET network, which interconnects Slovak universities and high schools and also provides a connection to the Internet. Similar to any other public-facing infrastructure, it is often the target of DDoS attacks. In this article, we are extending our previous research, mainly by dealing with the use of various statistical parameters for DDoS attack detection. We tested the coefficients of Variation, Kurtosis, Skewness, Autoregression, Correlation, Hurst exponent, and Kullback–Leibler Divergence estimates on traffic captures of different types of DDoS attacks. For early machine recognition of the attack, we have proposed several detection functions that use the response of the investigated statistical parameters to the start of a DDoS attack. The proposed detection methods are easily implementable for monitoring actual IP traffic.

show abstract

Section: Related Workmentioning

confidence: 99%

Machine Recognition of DDoS Attacks Using Statistical Parameters

Smiesko,

Segec,

Kontsek

2023

Mathematics

View full text Add to dashboard Cite

show abstract

“…A popular and effective method is the PCA decomposition method. The authors of the article [24] used a PCA as an indicator of anomalies in IP flow. A dimensionality reduction of the dataset of IP flow attributes using a PCA and the subsequent detection using entropy was used in [25].…”

Section: Related Workmentioning

confidence: 99%

One-Parameter Statistical Methods to Recognize DDoS Attacks

et al. 2022

View full text Add to dashboard Cite

Within our academic high-speed network infrastructure which is used for connecting all universities and high schools in our country to the Internet, there are thousands of cybersecurity attacks occurring every day. That is why, within our SANET II project, an effort has been made to create a self-learning system without a teacher, which would be able to quickly adapt to arbitrary traffic and recognize DDoS attacks on time, even in high-speed networks, with a potential simple implementation into a hardware probe. In the article, we deal with the Hurst and autoregression coefficients and the coefficient of variation. We test the coefficients on simulated data and on real records of attacks. For early machine recognition of the attack, we propose the so-called predicting σ-tunnel. The obtained results can lead to the investigation of other prediction methods that would improve the early recognition of an attack.

show abstract