Detecting Anomalies Using Entropy of ICMP Packet

摘要：

In the past several decades, many anomaly detection methods in Internet have been proposed. However, nearly all of the prior studies work at the cost of a lot of statistical work because of focusing on the whole Internet traffic. We attempt to exploit a more effective anomaly detection method based on Entropy of ICMP. Since two different type DATA sets, including ICMPv4 data as well as ICMPv6 data, are investigated, our central results are the following: Firstly, Entropy of ICMP is relatively stable. Entropy of IP packet protocols, Entropy of ICMP message types and Entropy of IP addresses are all slightly fluctuate around their own mean values. Therefore, abnormality in internet traffic can be detected by identifying abrupt changes of Entropy of ICMP. Secondly, for normal ICMP traffic, arrival process of packets exhibit stability and ICMP packets per time unit hold one relatively stable value.

关键词： ICMPv4 ICMPv6 Entropy Anomaly Detection

作者: Waixi Liu Shun-Zheng Yu

作者单位: Department of Electronic and Communication Engineering,Sun Yat-Sen University,Guangzhou,P.R.China De Department of Electronic and Communication Engineering,Sun Yat-Sen University,Guangzhou,P.R.China

会议类型: 国际会议

会议名称: 2011 3rd International Conference on Computer and Network Technology(ICCNT 2011)(2011第三届IEEE计算机与网络技术国际会议)

会议地点: 太原

会议语种:英文

页码: 10-13

在线出版日期: 2011-02-26（万方平台首次上网日期，不代表论文的发表时间）