Data compression using dynamic Markov modelling
The Computer Journal
Arithmetic coding for data compression
Communications of the ACM
The 1999 DARPA off-line intrusion detection evaluation
Computer Networks: The International Journal of Computer and Telecommunications Networking - Special issue on recent advances in intrusion detection systems
A Mathematical Theory of Communication
A Mathematical Theory of Communication
Wireshark & Ethereal Network Protocol Analyzer Toolkit (Jay Beale's Open Source Security)
Wireshark & Ethereal Network Protocol Analyzer Toolkit (Jay Beale's Open Source Security)
IBM Journal of Research and Development
Hi-index | 0.00 |
In the last few years, the number and impact of security attacks over the Internet have been continuously increasing. Since it seems impossible to guarantee complete protection to a system by means of the "classical" prevention mechanisms, the use of Intrusion Detection Systems has emerged as a key element in network security. In this paper we address the problem considering some techniques for detecting network anomalies. Our approach is based on the use of different compression algorithms for detecting anomalies in the network traffic running over TCP. In more detail we take into account the use of three different compression algorithms, based on distinct approaches, namely: Huffman coding, Dynamic Markov Coding, and Lempel-Ziv-Welch algorithm. The proposed methods are based on the consideration that the entropy represents a lower bound to the compression rate that we can obtain, and that the more redundant the data are and the better we can compress them. The performance analysis, presented in this paper, demonstrates the effectiveness of the proposed methods.