Network Anomaly Detection with Incomplete Audit Data

DMCA

Network Anomaly Detection with Incomplete Audit Data (2006)

Cached

Download Links

Other Repositories/Bibliography

DBLP

by Animesh Patcha , Dr. Luiz , A. Dasilva , Dr. Sandeep , K. Shukla , Dr. Christopher , L. North , Animesh Patcha , Late Smt Anasuya Devi

Citations:

2 - 0 self

BibTeX

@MISC{Patcha06networkanomaly,
    author = {Animesh Patcha and Dr. Luiz and A. Dasilva and Dr. Sandeep and K. Shukla and Dr. Christopher and L. North and Animesh Patcha and Late Smt Anasuya Devi},
    title = {Network Anomaly Detection with Incomplete Audit Data},
    year = {2006}
}

OpenURL

Abstract

With the ever increasing deployment and usage of gigabit networks, traditional network anomaly detection based intrusion detection systems have not scaled accordingly. Most, if not all, systems deployed assume the availability of complete and clean data for the purpose of intrusion detection. We contend that this assumption is not valid. Factors like noise in the audit data, mobility of the nodes, and the large amount of data generated by the network make it difficult to build a normal traffic profile of the network for the purpose of anomaly detection. From this perspective, the leitmotif of the research effort described in this dissertation is the design of a novel intrusion detection system that has the capability to detect intrusions with high accuracy even when complete audit data is not available. In this dissertation, we take a holistic approach to anomaly detection to address the threats posed by network based denial-of-service attacks by proposing improvements in every step of the intrusion detection process. At the data collection phase, we have implemented an adaptive sam-pling scheme that intelligently samples incoming network data to reduce the volume of traffic sampled, while maintaining the intrinsic characteristics of the network traffic. A Bloom filters based fast flow aggregation scheme is employed at the data pre-processing stage to further reduce the response time of the anomaly detection scheme. Lastly, this dissertation also proposes an expectation-maximization algorithm based anomaly detec-tion scheme that uses the sampled audit data to detect intrusions in the incoming network traffic. ii In loving memory of my grandparents

Keyphrases

network anomaly detection incomplete audit data holistic approach sampled audit data expectation-maximization algorithm intrinsic characteristic data pre-processing stage network traffic clean data intrusion detection complete audit data audit data anomaly detection traditional network anomaly detection gigabit network intrusion detection process response time research effort flow aggregation scheme intrusion detection system anomaly detection scheme anomaly detec-tion scheme data collection phase network data denial-of-service attack normal traffic profile incoming network traffic novel intrusion detection system bloom filter large amount high accuracy adaptive sam-pling scheme

DMCA