Substantiating Anomalies In Wireless Networks Using Group Outlier Scores

Abstract

<span style="font-family: Times New Roman; font-size: xx-small;"><span style="font-family: Times New Roman; font-size: xx-small;"><p>Huge amounts of network traces can be collected from today&rsquo;s busy computer networks. Analyzing these traces could pave the way to detect unusual conditions and/or other anomalies. Presently, due to the lack of effective substantiating mechanisms intrusion detection systems often exhibit numerous false positives or negatives. The efficiency of a network intrusion detection system (NIDS) depends very much on detecting and effectively validating the detected anomalies. Furthermore, most NIDSs do not have proven mechanisms that will easily accommodate legitimate dynamic changes. Achieving dynamic adaptation in real time has been a long standing desire for effective intrusion detection and prevention. Real time detection of outliers is a feasible option to substantiate anomalies in large data sets, leading to effective intrusion detection and prevention. In this context we propose and investigate a novel mechanism to detect intruders and to classify security threats using group outliers. Our system monitors for timing and/or behavioral anomalies and uses outlier based techniques to substantiate the anomaly. In this paper we introduce the concept of Group Outlier Score (GOS) and its use in substantiating security threats in wireless networks. We have tested the concept on our experimental wireless networking environment. The analysis of the results reveals that with a threshold value of 1.2 for GOS our system demonstrates optimum performance.</p></span></span

Outlier Detection in Big Data

“…Another approach is to validate anomalies once they have been detected to remove false positives. Sithirasenan and Muthukkumarasamy (2011) analyzed network intrusion data from different viewpoints and calculated an outlier score by comparing each outlier found with the data of its nearest neighbors using entropy.…”