Network anomaly detection and classification via opportunistic sampling

G Androulidakis, V Chatzigiannakis… - IEEE …, 2009 - ieeexplore.ieee.org
G Androulidakis, V Chatzigiannakis, S Papavassiliou
IEEE network, 2009ieeexplore.ieee.org
In this article the emphasis is placed on the evaluation of the impact of intelligent flow
sampling techniques on the detection and classification of network anomalies. Based on the
observation that for specific-purpose applications such as anomaly detection a large fraction
of information is contained in a small fraction of flows, we demonstrate that by using
sampling techniques that opportunistically and preferentially sample traffic data, we achieve
magnification of the appearance of anomalies within the sampled data set and therefore …
In this article the emphasis is placed on the evaluation of the impact of intelligent flow sampling techniques on the detection and classification of network anomalies. Based on the observation that for specific-purpose applications such as anomaly detection a large fraction of information is contained in a small fraction of flows, we demonstrate that by using sampling techniques that opportunistically and preferentially sample traffic data, we achieve magnification of the appearance of anomalies within the sampled data set and therefore improve their detection. Therefore, the inherently lossy sampling process is transformed to an advantageous feature in the anomaly detection case, allowing the revealing of anomalies that would be otherwise untraceable, and thus becoming the vehicle for efficient anomaly detection and classification. The evaluation of the impact of intelligent sampling techniques on the anomaly detection process is based on the application of an entropy-based anomaly detection method on a packet trace with data that has been collected from a real operational university campus network.
ieeexplore.ieee.org
以上显示的是最相近的搜索结果。 查看全部搜索结果