Improving PCA-based anomaly detection by using multiple time scale analysis and Kullback-Leibler divergence

International Journal of Communication Systems

Volumn 27, Issue 10, 2014, Pages 1731-1751

  Callegari, Christian ^a   Gazzarrini, Loris ^a   Giordano, Stefano ^a   Pagano, Michele ^a   Pepe, Teresa ^a  

^a UNIVERSITY OF PISA   (Italy)

Author keywords

Anomaly detection; K L divergence; Multiple time scale; PCA

Indexed keywords

STATISTICS;

KULLBACK LEIBLER DIVERGENCE; MULTI SCALE ANALYSIS; MULTIPLE TIME SCALE; NETWORK ANOMALIES; NETWORK ATTACK; NETWORK OPERATOR; PERFORMANCE ANALYSIS; STATE OF THE ART;

ANOMALY DETECTION;

EID: 84911989710     PISSN: 10745351     EISSN: 10991131     Source Type: Journal    
DOI: 10.1002/dac.2432     Document Type: Article

References (22)

1. Sun B, Wu K, Xiao Y, Wang R. Integration of mobility and intrusion detection for wireless ad hoc networks. International Journal of Communication Systems 2007; 20(6):695-721. DOI: 10.1002/dac.853. Available from: http://dx.doi.org/10.1002/dac.853
2. Djemaiel Y, Rekhis S, Boudriga N. Intrusion detection and tolerance: a global scheme. International Journal of Communication Systems 2008; 21(2):211-230. DOI: 10.1002/dac.895. Available from: http://dx.doi.org/10.1002/dac.895
3. Chen R-M, Hsieh K-T. Effective allied network security system based on designed scheme with conditional legitimate probability against distributed network attacks and intrusions. International Journal of Communication Systems 2012; 25(5):672-688. DOI: 10.1002/dac.1289. Available from: http://dx.doi.org/10.1002/dac.1289
4. Lakhina A. Diagnosing network-wide traffic anomalies. ACM SIGCOMM, Portland, OR, 2004; 219-230.
5. Lakhina A, Crovella M, Diot C. Characterization of network-wide anomalies in traffic flows. ACM Internet Measurement Conference, Taormina, Sicily, Italy, 2004; 201-206.
6. Lakhina A, Crovella M, Diot C. Mining anomalies using traffic feature distributions. Technical Report, 2005.
7. Li X, Bian F, Crovella M, Diot C, Govindan R, Iannaccone G, Lakhina A. Detection and identification of network anomalies using sketch subspaces. In IMC '06: Proceedings of the 6th ACM SIGCOMM conference on Internet measurement. ACM: New York, NY, USA, 2006; 147-152. Available from: http://doi.acm.org/10.1145/1177080. 1177099
8. Callegari C, Gazzarrini L, Giordano S, Pagano M, Pepe T. A novel multi time-scales PCA-based anomaly detection system. 2010 International Symposium on Performance Evaluation of Computer and Telecommunication Systems (SPECTS), Ottawa, Canada, 2010.
9. Shyu M-L, Chen S-C, Sarinnapakorn K, Chang L. A novel anomaly detection scheme based on principal component classifier. IEEE Foundations and New Directions of Data Mining Workshop, in Conjunction with ICDM03, Melbourne, Florida, 2003; 172-179.
10. Lakhina A, Papagiannaki K, Crovella M, Diot C, Kolaczyk ED, Taft N. Structural analysis of network traffic flows. ACM SIGMETRICS, New York, New York, 2004; 61-72.
11. Ringberg H, Soule A, Rexford J, Diot C. Sensitivity of PCA for traffic anomaly detection. ACM SIGMETRICS Performance Evaluation Review 2007; 35(1):109-120. Available from: http://doi.acm.org/10.1145/1269899. 1254895
12. Wang W, Battiti R. Identifying intrusions in computer networks with principal component analysis. In ARES '06: Proceedings of the First International Conference on Availability, Reliability and Security. IEEE Computer Society: Washington, DC, USA, 2006; 270-279. Available from: http://dx.doi.org/10.1109/ARES.2006.73
13. Bouzida Y, Cuppens F, Cuppens-Boulahia N, Gombault S. Efficient intrusion detection using principal component analysis. 3ème conférence sur la sécurité et architectures réseaux, La Londe, France, juin, RSM-Dépt. Réseaux, Sécurité et Multimédia (Institut Télécom-Télécom Bretagne), La Londe, France; 2004.
14. Wang W, Guan X, Zhang X. A novel intrusion detection method based on principal component analysis. Computer Security, Advances in Neural Networks, International IEEE Symposium on Neural Networks, Lecture, Dalian, China, 2004; 657-662.
15. Chatzigiannakis V, Papavassiliou S, Androulidakis G. Improving network anomaly detection effectiveness via an integrated multi-metric-multi-link (M3L) PCA-based approach. Security and Communication Networks 2009; 2(3):289-304.
16. Cormode G, Muthukrishnan S. An improved data stream summary: the count-min sketch and its applications. Journal of Algorithms 2005; 55(1):58-75. DOI: 10.1016/j.jalgor.2003.12.001. Available from: http://www.sciencedirect.com/science/article/B6WH3-4BM8Y1G-1/2/71b7980bb85b570bc57ee73f8afcd62f
17. Thorup M, Zhang Y. Tabulation based 4-universal hashing with applications to second moment estimation. In SODA '04: Proceedings of the Fifteenth Annual ACM-SIAM Symposium on Discrete Algorithms. Society for Industrial and Applied Mathematics: Philadelphia, PA, USA, 2004; 615-624.
18. Claise B. Cisco Systems NetFlow Services Export Version 9, RFC 3954 (Informational), October 2004. Available from: http://www.ietf.org/rfc/rfc3954.txt
19. Flow-Tools Home Page. Available from: http://www.ietf.org/rfc/rfc3954.txt
20. Lippmann R, Haines J, Fried D, Korba J, Das K. The 1999 DARPA off-line intrusion detection evaluation. Computer Networks 2000; 34(4):579-595.
21. Mahoney MV, Chan PK. An analysis of the 1999 DARPA/Lincoln laboratory evaluation data for network anomaly detection. In Proceedings of the Sixth International Symposium on Recent Advances in Intrusion Detection. Springer-Verlag: Springer Berlin, Heidelberg, 2003; 220-237.
22. The Internet2 Network. Available from: http://www.internet2.edu/network/