Abstract:Anomaly detection is an important technique used to identify patterns of unusual network behavior and keep the network under control. Today, network attacks are increasing in terms of both their number and sophistication. To avoid causing significant traffic patterns and being detected by existing techniques, many new attacks tend to involve gradual adjustment of behaviors, which always generate incomplete sessions due to their running mechanisms. Accordingly, in this work, we employ the behavior symmetry degree to profile the anomalies and further identify unusual behaviors. We first proposed a symmetry degree to identify the incomplete sessions generated by unusual behaviors; we then employ a sketch to calculate the symmetry degree of internal hosts to improve the identification efficiency for online applications. To reduce the memory cost and probability of collision, we divide the IP addresses into four segments that can be used as keys of the hash functions in the sketch. Moreover, to further improve detection accuracy, a threshold selection method is proposed for dynamic traffic pattern analysis. The hash functions in the sketch are then designed using Chinese remainder theory, which can analytically trace the IP addresses associated with the anomalies. We tested the proposed techniques based on traffic data collected from the northwest center of CERNET (China Education and Research Network); the results show that the proposed methods can effectively detect anomalies in large-scale networks.

Anomaly Detection in SMTP Traffic

An Effective Anomaly Detection Method in SMTP Traffic

Packet Payload Based Anomalous Network Intrusion Detection

Real-time Anomaly Detection Model for Worm Mails in High-Speed Network

Anomaly detection for network traffic flow

Anomaly Detection in Emails using Machine Learning and Header Information

An anomaly detection method of E-mail account based on client behaviors

Anomaly Detection Using the Dempster-Shafer Method

Anomaly Detection of Network Traffic Based on Wavelet Packet

Symmetry Degree Measurement and Its Applications to Anomaly Detection

Online Network traffic anomaly detection method combining OS-ELM and SADE

Dempster-Shafer for Anomaly Detection

A Transform Domain-Based Anomaly Detection Approach To Network-Wide Traffic

An Effective Method for Computer Network Anomaly Detection

Research on Dynamic Data Flow Anomaly Detection based on Machine Learning

Anomaly Detections in Internet traffic Using Empirical Measures

SMTP traffic simulation for intrusion detection dataset evaluation

Study of Anomaly Intrusion Detection Influencing Factors Based on Byte Frequency

Effect Improved for High-Dimensional and Unbalanced Data Anomaly Detection Model Based on KNN-SMOTE-LSTM

Anomaly Detection of Network Flooding Attacks

High-speed anomaly traffic detection based on staged frequency domain features