The role of KL divergence in anomaly detection

Authors:
Lele Zhang;Darryl Veitch;Kotagiri Ramamohanarao
Affiliations:
The University of Melbourne, Melbourne, Australia;The University of Melbourne, Melbourne, Australia;The University of Melbourne, Melbourne, Australia
Venue:
ACM SIGMETRICS Performance Evaluation Review - Performance evaluation review
Year:
2011

Citing 4
Cited 0

Detecting anomalies in network traffic using maximum entropy estimation

IMC '05 Proceedings of the 5th ACM SIGCOMM conference on Internet Measurement
An empirical evaluation of entropy-based traffic anomaly detection

Proceedings of the 8th ACM SIGCOMM conference on Internet measurement
Scan Surveillance in Internet Networks

NETWORKING '09 Proceedings of the 8th International IFIP-TC 6 Networking Conference
A two-layered anomaly detection technique based on multi-modal flow behavior models

PAM'08 Proceedings of the 9th international conference on Passive and active network measurement

Quantified Score

Hi-index	0.00

Visualization

Abstract

We study the role of Kullback-Leibler divergence in the framework of anomaly detection, where its abilities as a statistic underlying detection have never been investigated in depth. We give an in-principle analysis of network attack detection, showing explicitly attacks may be masked at minimal cost through 'camouflage'. We illustrate on both synthetic distributions and ones taken from real traffic.