An On-Line Anomaly Detection Method Based on a New Stationary Metric - Entropy-Ratio

Ziyu Wang,Jiahai Yang,Fuliang Li
DOI: https://doi.org/10.1109/TrustCom.2014.16
2014-01-01
Abstract:Anomaly detection has been a hot topic in recent years due to its capability of detecting zero day attacks. In this paper, we propose a new metric called Entropy-Ratio. We validate that the Entropy-Ratio is stationary. Making use of this observation, we combine the Least Mean Square algorithm and the Forward Linear Predictor to propose a new on-line detector called LMS-FLP detector. Using the two synthetic data sets - CEGI-6IX synthetic data and CERNET2 synthetic data, we validate that the LMS-FLP detector is very effective in detecting both anomalies involving many small IP flows and anomalies involving a few large IP flows.
What problem does this paper attempt to address?