Publication Date:
2013-10-02
Description:
In this paper, we present a statistical analysis of six traffic features based on entropy and distinct feature number at the packet level, and we find that, although these traffic features are unstable and show seasonal patterns like traffic volume in a long-time period, they are stable and consistent with Gaussian distribution in a short-time period. However, this equilibrium property will be violated by some anomalies. Based on this observation, we propose a Multi-dimensional Box plot method for Short-time scale Traffic (MBST) to classify abnormal and normal traffic. We compare our new method with the MCST method proposed in our prior work and the well-known wavelet-based and A Short-Timescale Uncorrelated-Traffic Equilibrium (ASTUTE) techniques. The detection result on synthetic anomaly traffic shows that MBST can better detect the low-rate attacks than wavelet-based and MCST methods, and detection result on real traffic demonstrates that MBST can detect more anomalies with lower false alarm rate than the two methods. Especially compared with ASTUTE, MBST performs much better for detecting anomalies involving a few large flows despite a little poor for detecting anomalies involving large number of small flows.
Print ISSN:
0010-4620
Electronic ISSN:
1460-2067
Topics:
Computer Science
Permalink
