Streaming Estimation of Information-Theoretic Metrics for Anomaly Detection (Extended Abstract)

Authors:
Sergey Bratus;Joshua Brody;David Kotz;Anna Shubina
Affiliations:
Institute for Security Technology Studies Department of Computer Science, Dartmouth College, USA;Institute for Security Technology Studies Department of Computer Science, Dartmouth College, USA;Institute for Security Technology Studies Department of Computer Science, Dartmouth College, USA;Institute for Security Technology Studies Department of Computer Science, Dartmouth College, USA
Venue:
RAID '08 Proceedings of the 11th international symposium on Recent Advances in Intrusion Detection
Year:
2008

Citing 6
Cited 1

Information-Theoretic Measures for Anomaly Detection

SP '01 Proceedings of the 2001 IEEE Symposium on Security and Privacy
Mining anomalies using traffic feature distributions

Proceedings of the 2005 conference on Applications, technologies, architectures, and protocols for computer communications
Data streaming algorithms for estimating entropy of network traffic

SIGMETRICS '06/Performance '06 Proceedings of the joint international conference on Measurement and modeling of computer systems
Detecting anomalies in network traffic using maximum entropy estimation

IMC '05 Proceedings of the 5th ACM SIGCOMM conference on Internet Measurement
A near-optimal algorithm for computing the entropy of a stream

SODA '07 Proceedings of the eighteenth annual ACM-SIAM symposium on Discrete algorithms
Towards an information-theoretic framework for analyzing intrusion detection systems

ESORICS'06 Proceedings of the 11th European conference on Research in Computer Security

Collaborative defence as a pervasive service: architectural insights and validation methodologies of a trial deployment

International Journal of Sensor Networks

Quantified Score

Hi-index	0.00

Visualization

Abstract

Information-theoretic metrics hold great promise for modeling traffic and detecting anomalies if only they could be computed in an efficient, scalable way. Recent advances in streaming estimation algorithms give hope that such computations can be made practical. We describe our work in progress that aims to use streaming algorithms on 802.11a/b/g link layer (and above) features and feature pairs to detect anomalies.