Learning-based algorithm for detecting abnormal traffic

Authors:
Changwoo Nam;Seongjin Ahn;Jinwook Chung
Affiliations:
Dept. of Electrical and Computer Engineering, Sungkyunkwan Univ., Suwon, Korea;Department of Computer Education, Sungkyunkwan Univ., Seoul, Korea;Dept. of Electrical and Computer Engineering, Sungkyunkwan Univ., Suwon, Korea
Venue:
ISPA'06 Proceedings of the 2006 international conference on Frontiers of High Performance Computing and Networking
Year:
2006

Citing 8
Cited 0

TCP/IP illustrated (vol. 1): the protocols

TCP/IP illustrated (vol. 1): the protocols
A Behavior-Based Anti-Worm System

AINA '03 Proceedings of the 17th International Conference on Advanced Information Networking and Applications
Designing a Framework for Active Worm Detection on Global Networks

IEEE-IWIA '03 Proceedings of the First IEEE International Workshop on Information Assurance (IWIA'03)
A taxonomy of computer worms

Proceedings of the 2003 ACM workshop on Rapid malcode
Worm Detection, Early Warning and Response Based on Local Victim Information

ACSAC '04 Proceedings of the 20th Annual Computer Security Applications Conference
On the performance of internet worm scanning strategies

Performance Evaluation
TCP/IP Protocol Suite

TCP/IP Protocol Suite
Automated worm fingerprinting

OSDI'04 Proceedings of the 6th conference on Symposium on Opearting Systems Design & Implementation - Volume 6

Quantified Score

Hi-index	0.00

Visualization

Abstract

Modern worm viruses not only tend to promote host attacks, but generate high volumes of traffic and frequently result in network failure. This paper proposes a learning-based algorithm for detecting abnormal traffic, ensuring efficient protection against worm viruses, and promoting network level security. The algorithm identifies abnormal traffic, and learns network level characteristics of this traffic, to prevent in advance factors that may result in network failure. The algorithm presented in this paper was applied to the network system, and simulation results showed that unlike previous network systems, the proposed algorithm more efficiency detects worm viruses, and overall, results in improved network security.