Abstract:The prosperity of mobile networks and social networks brings revolutionary conveniences to our daily lives. However, due to the complexity and fragility of the network environment, network attacks are becoming more and more serious. Characterization of network traffic is commonly used to model and detect network anomalies and finally to raise the cybersecurity awareness capability of network administrators. As a tool to characterize system running status, entropy-based time-series complexity measurement methods such as Multiscale Entropy (MSE), Composite Multiscale Entropy (CMSE), and Fuzzy Approximate Entropy (FuzzyEn) have been widely used in anomaly detection. However, the existing methods calculate the distance between vectors solely using the two most different elements of the two vectors. Furthermore, the similarity of vectors is calculated using the Heaviside function, which has a problem of bouncing between 0 and 1. The Euclidean Distance-Based Multiscale Fuzzy Entropy (EDM-Fuzzy) algorithm was proposed to avoid the two disadvantages and to measure entropy values of system signals more precisely, accurately, and stably. In this paper, the EDM-Fuzzy is applied to analyze the characteristics of abnormal network traffic such as botnet network traffic and Distributed Denial of Service (DDoS) attack traffic. The experimental analysis shows that the EDM-Fuzzy entropy technology is able to characterize the differences between normal traffic and abnormal traffic. The EDM-Fuzzy entropy characteristics of ARP traffic discovered in this paper can be used to detect various types of network traffic anomalies including botnet and DDoS attacks.

Entropy Based Method for Network Anomaly Detection

Packet Payload Based Anomalous Network Intrusion Detection

Characterizing Network Anomaly Traffic with Euclidean Distance-Based Multiscale Fuzzy Entropy.

An Intrusion Alarming System Based on Self-Similarity of Network Traffic

An Approach on Detecting Network Attack Based on Entropy

A Method to Detect Network Attacks Using Entropy in the Intrusion Detection System

Using Cross Entropy to Detect and Classify Network Anomalous Traffic

Adjustable Piecewise Entropy for Network Traffic Anomaly Detection

Entropy-Defined Direct Batch Growing Hierarchical Self-Organizing Mapping for Efficient Network Anomaly Detection

An Unsupervised Network Intrusion Detection Based on Anomaly Analysis

An On-Line Anomaly Detection Method Based on a New Stationary Metric - Entropy-Ratio

Anomaly network traffic detection algorithm based on information entropy measurement under the cloud computing environment

A Rough Set Theory Based Method for Anomaly Intrusion Detection in Computer Network Systems

Network Anomaly Detection Based on Statistical Approach and Time Series Analysis

Network Anomaly Detection Using Unsupervised Feature Selection and Density Peak Clustering.

A Network Anomaly Detection Algorithm Based on Natural Neighborhood Graph.

Analysis of Entropy Sensitivity in Anomalies Detection

A New Attack Detection in Large Scale Network Based on Entropy.

PRACTICAL NETWORK ANOMALY DETECTION USING DATA MINING TECHNIQUES

Network-based Anomaly Intrusion Detection with Numeric-and-nominal Mixed Data

A Novel Network Intrusion Detection Algorithm Based on Density Estimation