ON-LINE ANOMALY DETECTION BASED ON RELATIVE ENTROPY

摘要：

Because the internet and computer networks are exposed to rapidly increasing number of serious security threats, efficient and effective anomaly detection techniques have become a necessity to secure the internet and computer networks . Traditional signature based anomaly detection techniques failed to detect polymorphic and new security threats. In this paper, we propose an online worm detection system based on relative entropy. The system effectively profiles network traffic features and then uses relative entropy to dynamically determine the traffic changes. It then applies adaptive filter to differentiate the traffic changes and determines whether the traffic is normal or contains worms. Our experimental results show that the proposed system is efficient for on-line anomaly detection, using traffic trace collected in high-speed links.

关键词： Network anomaly detection Network entropy relative network entropy

作者: Altyeb Altaher Sureswaran Ramadass Bhavani Thuraisingham Mohammad Mehedy

作者单位: National Advanced IPv6 Center of Excellence Universiti Sains Malaysia, Malaysia The University of Texas at Dallas, USA

会议类型: 国际会议

会议名称: 2011 4th IEEE International Conference on Broadband Network & Multimedia Technology(第四届IEEE宽带网络与多媒体国际会议 4th IEEE IC-BNMT2011)

会议地点: 深圳

会议语种:英文

页码: 33-36

在线出版日期: 2011-10-28（万方平台首次上网日期，不代表论文的发表时间）