Multivariate correlation analysis technique based on Euclidean distance map for network traffic characterization

Authors:
Zhiyuan Tan;Aruna Jamdagni;Xiangjian He;Priyadarsi Nanda;Ren Ping Liu
Affiliations:
Research Centre for Innovation in IT Services and Applications, University of Technology, Sydney, Australia and CSIRO Marsfield, Australia;Research Centre for Innovation in IT Services and Applications, University of Technology, Sydney, Australia and CSIRO Marsfield, Australia;Research Centre for Innovation in IT Services and Applications, University of Technology, Sydney, Australia;Research Centre for Innovation in IT Services and Applications, University of Technology, Sydney, Australia;Research Centre for Innovation in IT Services and Applications, University of Technology, Sydney, Australia and CSIRO Marsfield, Australia
Venue:
ICICS'11 Proceedings of the 13th international conference on Information and communications security
Year:
2011

Citing 16
Cited 0

An Intrusion-Detection Model

IEEE Transactions on Software Engineering - Special issue on computer security and privacy
Temporal sequence learning and data reduction for anomaly detection

ACM Transactions on Information and System Security (TISSEC)
Bro: a system for detecting network intruders in real-time

Computer Networks: The International Journal of Computer and Telecommunications Networking
KDD Cup 2001 report

ACM SIGKDD Explorations Newsletter
Multivariate Statistical Analysis of Audit Trails for Host-Based Intrusion Detection

IEEE Transactions on Computers
Hop-count filtering: an effective defense against spoofed DDoS traffic

Proceedings of the 10th ACM conference on Computer and communications security
Snort - Lightweight Intrusion Detection for Networks

LISA '99 Proceedings of the 13th USENIX conference on System administration
Network intrusion detection in covariance feature space

Pattern Recognition
An overview of anomaly detection techniques: Existing solutions and latest technological trends

Computer Networks: The International Journal of Computer and Telecommunications Networking
DDoS attack detection method using cluster analysis

Expert Systems with Applications: An International Journal
A Novel Covariance Matrix Based Approach for Detecting Network Anomalies

CNSR '08 Proceedings of the Communication Networks and Services Research Conference
A triangle area based nearest neighbors approach to intrusion detection

Pattern Recognition
A new approach to intrusion detection using Artificial Neural Networks and fuzzy clustering

Expert Systems with Applications: An International Journal
Intrusion detection using GSAD model for HTTP traffic on web services

Proceedings of the 6th International Wireless Communications and Mobile Computing Conference
A two-tier system for web attack detection using linear discriminant method

ICICS'10 Proceedings of the 12th international conference on Information and communications security
Network intrusion and fault detection: a statistical anomaly approach

IEEE Communications Magazine

Quantified Score

Hi-index	0.03

Visualization

Abstract

The quality of feature has significant impact on the performance of detection techniques used for Denial-of-Service (DoS) attack. The features that fail to provide accurate characterization for network traffic records make the techniques suffer from low accuracy in detection. Although researches have been conducted and attempted to overcome this problem, there are some constraints in these works. In this paper, we propose a technique based on Euclidean Distance Map (EDM) for optimal feature extraction. The proposed technique runs analysis on original feature space (first-order statistics) and extracts the multivariate correlations between the first-order statistics. The extracted multivariate correlations, namely second-order statistics, preserve significant discriminative information for accurate characterizations of network traffic records, and these multivariate correlations can be the high-quality potential features for DoS attack detection. The effectiveness of the proposed technique is evaluated using KDD CUP 99 dataset and experimental analysis shows encouraging results.