As the typical anomaly detection methods using statistics, entropy and chi(2) based method has been researched and reported with their performance properties for anomaly attacks. In this research, we compare the time ...
详细信息
ISBN:
(纸本)9780769548425
As the typical anomaly detection methods using statistics, entropy and chi(2) based method has been researched and reported with their performance properties for anomaly attacks. In this research, we compare the time complexity of two our proposed detection method aiming to evaluate the performance of our system. Our previous researches have clarified that the source IP address and destination port number are efficient statistical variables to view the anomaly packet property, which lead to detect correctly. In this paper, we propose EMMM method for entropy value and CSDM method of chi(2) value using multi statistical variables. The evaluation to verify the time complexity of our proposed methods were conducted using source IP address, destination port number and arriving interval of packets. We could extract the following results. Firstly, the total time complexity of the EMMM method is O(n) for the n total packets, and the time complexity of one window is O(W). Secondly, the time complexity of CSDM for one window is O(NW + N m log m).
In the research of the anomaly detection system analyzing the packet header on the Internet, previous researches have proposed the anomaly detection system using chi-square values in terms of the source IP address and...
详细信息
ISBN:
(纸本)9780769543376
In the research of the anomaly detection system analyzing the packet header on the Internet, previous researches have proposed the anomaly detection system using chi-square values in terms of the source IP address and/or the destination port number. In these previous researches, the chi-square values were calculated from one feature causing the degradation in the False-Positive when the same symbol appears sequentially. Therefore, we propose the anomaly detection technique using chi-square values based on multi features. We also propose dynamic BIN division technique to deal with the traffic fluctuations such as day and night traffic differences. Applying our method, the chi-square values based on the time division were able to decrease the False-Positive. Our method was also able to adapt the traffic variations by applying the dynamic BIN division technique.
The statistic researches have been proposed to detect anomaly attacks using chi-square. In these researches, features such as the IP address and the port number are used as the probabilistic variables. The method base...
详细信息
The conventional methods using χ2 value have been proposed to detect anomaly attacks. These systems, however, merely treat the one feature such as the source IP address or the destination port number as the probabili...
详细信息
Improperly configured Domain Name System (DNS) servers are sometimes used as packet reflectors as part of a dos or ddos attack. Detecting packets created as a result of this activity is logically possible by monitorin...
详细信息
ISBN:
(纸本)9781728155845
Improperly configured Domain Name System (DNS) servers are sometimes used as packet reflectors as part of a dos or ddos attack. Detecting packets created as a result of this activity is logically possible by monitoring the DNS request and response traffic. Any response that does not have a corresponding request can be considered a reflected message;checking and tracking every DNS packet, however, is a non-trivial operation. In this paper, we propose a detection mechanism for DNS servers used as reflectors by using a DNS server feature matrix built from a small number of packets and a machine learning algorithm. The F1 score of bad DNS server detection was over 0.9 when the test and training data are generated within the same day.
With the IPv6 becomes more and more popular, people start to notice its security problems. The problems not only happen in the protocol itself, but also exist in the deployment scenarios. In this paper, we present our...
详细信息
With the IPv6 becomes more and more popular, people start to notice its security problems. The problems not only happen in the protocol itself, but also exist in the deployment scenarios. In this paper, we present our research about detecting Do S/DDo S attack under IPv4/IPv6 translation covert channel. The NAT64/DNS64 is the translation scheme which focused. The two scenes test in this research show the attacks launch from IPv6 side still can affect the IPv4 host a lot and can hide the source of attackers owing to the covert channel effect. We walk around the classical methods and make our new rules for detecting the attacks. The results show promise for our rules which can detect SYN6 and Smurf6 attack from IPv4 host correctly.
暂无评论