Abstract:The prosperity of mobile networks and social networks brings revolutionary conveniences to our daily lives. However, due to the complexity and fragility of the network environment, network attacks are becoming more and more serious. Characterization of network traffic is commonly used to model and detect network anomalies and finally to raise the cybersecurity awareness capability of network administrators. As a tool to characterize system running status, entropy-based time-series complexity measurement methods such as Multiscale Entropy (MSE), Composite Multiscale Entropy (CMSE), and Fuzzy Approximate Entropy (FuzzyEn) have been widely used in anomaly detection. However, the existing methods calculate the distance between vectors solely using the two most different elements of the two vectors. Furthermore, the similarity of vectors is calculated using the Heaviside function, which has a problem of bouncing between 0 and 1. The Euclidean Distance-Based Multiscale Fuzzy Entropy (EDM-Fuzzy) algorithm was proposed to avoid the two disadvantages and to measure entropy values of system signals more precisely, accurately, and stably. In this paper, the EDM-Fuzzy is applied to analyze the characteristics of abnormal network traffic such as botnet network traffic and Distributed Denial of Service (DDoS) attack traffic. The experimental analysis shows that the EDM-Fuzzy entropy technology is able to characterize the differences between normal traffic and abnormal traffic. The EDM-Fuzzy entropy characteristics of ARP traffic discovered in this paper can be used to detect various types of network traffic anomalies including botnet and DDoS attacks.

Information Entropy Based Clustering Method for Unsupervised Internet Traffic Classification

Traffic Classification - Towards Accurate Real Time Network Applications

Network Traffic Classification Algorithm Based on Spectral Clustering

Towards a Profiling View for Unsupervised Traffic Classification by Exploring the Statistic Features and Link Patterns

An enhanced self-learning-based clustering scheme for real-time traffic data distribution in wireless networks

Identifying Traffic Clusters in Urban Networks Based on Graph Theory Using License Plate Recognition Data

An SVM-based machine learning method for accurate internet traffic classification

Unsupervised Anomalous Traffic Detection Based on Cascading Representation and Multiple-Clustering

Accurate Classification of the Internet Traffic Based on the SVM Method

Internet Traffic Analysis in a Large University Town: A Graphical and Clustering Approach.

Bot Detection Using Unsupervised Machine Learning

Hybrid Internet Traffic Classification Technique

A method of on-line fast identification for the chaos in traffic flow

A Self-Supervised Learning Model for Unknown Internet Traffic Identification Based on Surge Period

Anomaly Detection Based on Traffic Information Structure

Characterizing Network Anomaly Traffic with Euclidean Distance-Based Multiscale Fuzzy Entropy.

Unsupervised Learning for Topological Classification of Transportation Networks

A traffic classification approach based on characteristics of subflows and ensemble learning

Modeling and clustering network-level urban traffic status based on traffic flow assignment ratios

Internet Traffic Classification Based on Random Forest

Application traffic classification based on command exchange mode of TCP flows