Hierarchical method for anomaly detection and attack identification in high-speed network

Information Technology Journal

Volumn 11, Issue 9, 2012, Pages 1243-1250

  Yan, Ruoyu ^a   Shao, Chao ^a  

^a HENAN UNIVERSITY OF ECONOMICS AND LAW   (China)

Author keywords

Anomaly detection; Consensus combination; Denial of service; Exponentially Weighted Moving Average; Hierarchical method; High speed network

Indexed keywords

ANOMALY DETECTION; CONSENSUS COMBINATION; DENIAL OF SERVICE; EXPONENTIALLY WEIGHTED MOVING AVERAGE; HIERARCHICAL METHOD; HIGH-SPEED;

DETECTORS; ENTROPY; HIERARCHICAL SYSTEMS;

HIGH SPEED NETWORKS;

EID: 84863186562     PISSN: 18125638     EISSN: 18125646     Source Type: Journal    
DOI: 10.3923/itj.2012.1243.1250     Document Type: Article

References (15)

1. CCRC, 2005. CSI/FBI computer crime and security survey[R/OL], [2005]. http://www.cybercrime.gov/CSI-FBI.htm
2. Corona, I., G. Giacinto and F. Roll, 2008. Intrusion detection in computer systems using multiple classifier systems. Stud. Comput. Intelhg., 126:91-113.
3. Deri, L., 2003. Passively monitoring networks at gigabit speeds using commodity hardware and open source software. Proceedings of the Passive and Active Measurement Conference, October 2003, Miami FL., pp:1-7.
4. Gao J., W. Fan, D. Turaga, O. Verscheure, X. Meng, L. Su and J. Han, 2011. Consensus extraction from heterogeneous detectors to improve performance over network traffic anomaly detection. Proceedings of the 31st Annual IEEE International Conference on Computer Communications, April 10-15, 2011, Shanghai, China, pp:181-185.
5. Gu, G., A. A. Cardenas and W. Lee, 2008. Principled reasoning and practical applications of alert fusion in intrusion detection systems. Proceedings of the ACM Symposium on Information, Computer and Communications Security, March 2011, Hong Kong, pp:136-147.
6. Guang, C, Y. Tang, J. Jiang and W. Ding, 2009. A trace measurement and analysis system for the multi-links CERMET backbone. Proceedings of the IEEE International Conference on Networking Architecture and Storage, July 28-30, 2009, Dalian, China, pp:341-346.
7. Kumar, K., R. C. Joshil and K. Singh, 2007. A distributed approach using entropy to detect DDoS attacks in ISP domain. Proceedings of the IEEE International Conference on Signal Processing, Communications and Networking, February 22-24, 2007, Chennai, India, pp:331-337. (Pubitemid 47304132)
8. Lakhina, A., M. Crovella and C. Diot, 2005. Mining anomalies using traffic feature distributions. ACM Sigcomm Comput. Commnn. Rev., 35:217-228. (Pubitemid 46323506)
9. Nychis, G., V. Sekar, D. G. Andersen, H. Kim and H. Zhang, 2008. An empirical evaluation of entropy-based traffic anomaly detection. Proceedings of the Internet Measurement Conference (IMC), October 2008, Vouliagmeni, Greece, pp:151-156.
10. Salem, O., A. Mehaoua, S. Vaton and A. Gravey, 2009. Flooding attacks detection and victim identification over high speed networks. Proceedings of the Global Information Infrastructure Symposium, August, 2009, Hammamet, Tunisia, pp:101-107.
11. Seni, G. and F. Elder, 2010. Ensemble Methods in Data Mining: Improving Accuracy through Combining Predictions. Morgan and Claypool, Chicago, IL. USA., pages:126.
12. Yan, R. and Q. Zheng, 2009. Using renyi cross entropy to analyze traffic matrix and detect DDoS attacks. Inform. Technol. J., 8:1180-1188.
13. Yan, R. and Y. Wang, 2012. Hurst parameter for security evaluation of LAN traffic. Inform. Technol. J., 11:269-275.
14. Yan, R., Q. Zheng and H. Li, 2010. Combining adaptive filtering and IF flows to detect DDoS attacks within a router. KSII Trans. Internet Inf. Syst, 4:428-451.
15. Zhi-Xin, S., T. Yi-Wei and C. Yuan, 2007. Router anomaly traffic white papers. http://www.cisco.com/en/US/technologies/tk543/tk812/