Anomaly detection through packet header data

Authors:
Sungkornsarun Longchupole;Noppadol Maneerat;Ruttikorn Varakulsiripunth
Affiliations:
Faculty of Engineering, King Mongkut's Institute of Technology Ladkrabang, Bangkok, Thailand;Faculty of Engineering, King Mongkut's Institute of Technology Ladkrabang, Bangkok, Thailand;Faculty of Engineering, King Mongkut's Institute of Technology Ladkrabang, Bangkok, Thailand
Venue:
ICICS'09 Proceedings of the 7th international conference on Information, communications and signal processing
Year:
2009

Citing 4
Cited 0

Self-similarity through high-variability: statistical analysis of ethernet LAN traffic at the source level

SIGCOMM '95 Proceedings of the conference on Applications, technologies, architectures, and protocols for computer communication
Snort - Lightweight Intrusion Detection for Networks

LISA '99 Proceedings of the 13th USENIX conference on System administration
Shift invariant properties of the dual-tree complex wavelet transform

ICASSP '99 Proceedings of the Acoustics, Speech, and Signal Processing, 1999. on 1999 IEEE International Conference - Volume 03
Statistical techniques for detecting traffic anomalies through packet header data

IEEE/ACM Transactions on Networking (TON)

Quantified Score

Hi-index	0.00

Visualization

Abstract

Intrusion Detection System (IDS) is a crucial part of network security area and is widely employed. Signature-based matching mechanisms require a completed analysis of attack patterns and the availability of knowledge detection beforehand. To cope with new attacks, IDS tools require to be continuously updated with the signature rules. In this paper, we present anomaly detection technique by using Complex Gaussian Coefficient to calculate the threshold for detecting unknown flooding attacks. The Network traffics are generated for three types of situations in the normal light traffic period, during the attacking period and in the heavy traffic period. The numbers of packets in time domain are transformed to complex Gaussian coefficient. The variances of the complex wavelet magnitude in each derivative level significantly describe network situation. This technique can be applied to detect unknown DDoS flooding patterns.