Abstract:The prosperity of mobile networks and social networks brings revolutionary conveniences to our daily lives. However, due to the complexity and fragility of the network environment, network attacks are becoming more and more serious. Characterization of network traffic is commonly used to model and detect network anomalies and finally to raise the cybersecurity awareness capability of network administrators. As a tool to characterize system running status, entropy-based time-series complexity measurement methods such as Multiscale Entropy (MSE), Composite Multiscale Entropy (CMSE), and Fuzzy Approximate Entropy (FuzzyEn) have been widely used in anomaly detection. However, the existing methods calculate the distance between vectors solely using the two most different elements of the two vectors. Furthermore, the similarity of vectors is calculated using the Heaviside function, which has a problem of bouncing between 0 and 1. The Euclidean Distance-Based Multiscale Fuzzy Entropy (EDM-Fuzzy) algorithm was proposed to avoid the two disadvantages and to measure entropy values of system signals more precisely, accurately, and stably. In this paper, the EDM-Fuzzy is applied to analyze the characteristics of abnormal network traffic such as botnet network traffic and Distributed Denial of Service (DDoS) attack traffic. The experimental analysis shows that the EDM-Fuzzy entropy technology is able to characterize the differences between normal traffic and abnormal traffic. The EDM-Fuzzy entropy characteristics of ARP traffic discovered in this paper can be used to detect various types of network traffic anomalies including botnet and DDoS attacks.

Security Evaluation Method Based on Real Time Traffic of Hosts

An Intrusion Alarming System Based on Self-Similarity of Network Traffic

Characterizing Network Anomaly Traffic with Euclidean Distance-Based Multiscale Fuzzy Entropy.

Technical Research on Computer Network Security Automatic Evaluation

Study on Evaluation for Security Situation of Networked Systems

A Quantitative Method for Evaluating Network Security Based on Attack Graph.

The Research on Real-time Security Situation Assessment Technology Based on the Threat Propagation Model.

Research on Situation Assessment of Active Distribution Networks Considering Cyberattacks

Study of Security Metrics of Software System for Comparative Evaluation

Network Security Situation Assessment Method Based on Absorbing Markov Chain.

Statistical Techniques for Detecting Cyberattacks on Computer Networks Based on an Analysis of Abnormal Traffic Behavior

Quantitative Hierarchical Threat Evaluation Model for Network Security

Computer Network Information Security Monitoring System Based on Big Data Era

Automated Big Traffic Analytics for Cyber Security

The Study on Evaluation Method of Urban Network Security in the Big Data Era

Composite Metrics for Network Security Analysis

DDoS detection and analysis system based on comprehensive scoring

An Adjacency Matrixes-Based Model for Network Security Analysis

Quantifiable Network Security Measurement - A Study Based on an Index System.

Detecting DDOS Attack Based on Network Self-Similarity

Computer network security evaluation method based on improved attack graph