Network intrusion and fault detection: a statistical anomaly approach

Authors:
C. Manikopoulos;S. Papavassiliou
Affiliations:
New Jersey Inst. of Technol., Newark, NJ, USA;-
Venue:
IEEE Communications Magazine
Year:
2002

Citing 0
Cited 34

Novelty detection: a review—part 1: statistical approaches

Signal Processing
Management of security in TCP/IP hosts using dedicated monitoring applications

Network control and engineering for Qos, security and mobility II
Detecting Network Attacks in the Internet via Statistical Network Traffic Normality Prediction

Journal of Network and Systems Management
Intrusion detection using hierarchical neural networks

Pattern Recognition Letters
Mitigating denial of service attacks: a tutorial

Journal of Computer Security
A Neural Network-Based Novelty Detector for Image Sequence Analysis

IEEE Transactions on Pattern Analysis and Machine Intelligence
One step ahead to multisensor data fusion for DDoS detection

Journal of Computer Security - Special issue on security track at ACM symposium on applied computing 2004
Survey of network-based defense mechanisms countering the DoS and DDoS problems

ACM Computing Surveys (CSUR)
Network intrusion detection in covariance feature space

Pattern Recognition
An analysis of distributed sensor data aggregation for network intrusion detection

Microprocessors & Microsystems
An application of supervised and unsupervised learning approaches to telecommunications fraud detection

Knowledge-Based Systems
Anomaly detection: A survey

ACM Computing Surveys (CSUR)
DDoS Attack Detection Algorithm Using IP Address Features

FAW '09 Proceedings of the 3d International Workshop on Frontiers in Algorithmics
A service-centric model for intrusion detection in next-generation networks

Computer Standards & Interfaces
A game theoretical framework on intrusion detection in heterogeneous networks

IEEE Transactions on Information Forensics and Security
Integrated "mixed" networks security monitoring: a proposed framework

ISI'03 Proceedings of the 1st NSF/NIJ conference on Intelligence and security informatics
A new approach to intrusion detection using Artificial Neural Networks and fuzzy clustering

Expert Systems with Applications: An International Journal
DDoS attack detection method based on linear prediction model

ICIC'09 Proceedings of the 5th international conference on Emerging intelligent computing technology and applications
Anomaly-based identification of large-scale attacks

GLOBECOM'09 Proceedings of the 28th IEEE conference on Global telecommunications
Drivers of information security search behavior: An investigation of network attacks and vulnerability disclosures

ACM Transactions on Management Information Systems (TMIS)
A data mining framework for detecting subscription fraud in telecommunication

Engineering Applications of Artificial Intelligence
A new mechanism for improving robustness of TCP against pulsing denial-of-service attacks

ACOS'06 Proceedings of the 5th WSEAS international conference on Applied computer science
Conversation exchange dynamics: a new signal primitive for visualizing network intrusion detection

ICECS'05 Proceedings of the 4th WSEAS international conference on Electronics, control and signal processing
Multivariate correlation analysis technique based on Euclidean distance map for network traffic characterization

ICICS'11 Proceedings of the 13th international conference on Information and communications security
Testing the fraud detection ability of different user profiles by means of FF-NN classifiers

ICANN'06 Proceedings of the 16th international conference on Artificial Neural Networks - Volume Part II
A resource allocating neural network based approach for detecting end-to-end network performance anomaly

ISNN'06 Proceedings of the Third international conference on Advances in Neural Networks - Volume Part III
Collaborative anomaly-based detection of large-scale internet attacks

Computer Networks: The International Journal of Computer and Telecommunications Networking
A covariance matrix based approach to internet anomaly detection

ICMLC'05 Proceedings of the 4th international conference on Advances in Machine Learning and Cybernetics
Construction of high precision RBFNN with low false alarm for detecting flooding based denial of service attacks using stochastic sensitivity measure

ICMLC'05 Proceedings of the 4th international conference on Advances in Machine Learning and Cybernetics
SAPA: software agents for prevention and auditing of security faults in networked systems

ICOIN'05 Proceedings of the 2005 international conference on Information Networking: convergence in broadband and mobile networking
Detection of variable length anomalous subsequences in data streams

International Journal of Intelligent Information and Database Systems
A modified support vector data description based novelty detection approach for machinery components

Applied Soft Computing
Evaluation on multivariate correlation analysis based denial-of-service attack detection system

Proceedings of the First International Conference on Security of Internet of Things
1-norm support vector novelty detection and its sparseness

Neural Networks

Quantified Score

Hi-index	0.25

Visualization

Abstract

With the advent and explosive growth of the global Internet and electronic commerce environments, adaptive/automatic network/service intrusion and anomaly detection in wide area data networks and e-commerce infrastructures is fast gaining critical research and practical importance. We present and demonstrate the use of a general-purpose hierarchical multitier multiwindow statistical anomaly detection technology and system that operates automatically, adaptively, and proactively, and can be applied to various networking technologies, including both wired and wireless ad hoc networks. Our method uses statistical models and multivariate classifiers to detect anomalous network conditions. Some numerical results are also presented that demonstrate that our proposed methodology can reliably detect attacks with traffic anomaly intensity as low as 3-5 percent of the typical background traffic intensity, thus promising to generate an effective early warning.