Network Anomaly Detection Based on Statistical Approach and
Network Anomaly Detection: Based on Statistical Approach and Time Series Analysis Huang Kai Qi Zhengwei Liu Bo Shanghai Jiao Tong University.
Outline n n n Problem description Data flow statistical characteristic Statistical Analysis Time Series Analysis Conclusion 5/18/2009 FINA'09
Problem description n Why statistical approach? n Network anomaly signature based approach. (DPI) u n Machining learning based approach. u 5/18/2009 Privacy problem. Hard to be real time. FINA'09
Problem description n Why our approach? n n 5/18/2009 Users’ different definition of network anomaly. Adaptability to the developing network. FINA'09
Data flow statistical characteristic n Complicated statistical characteristics! n Poisson process u u n Exponential process u n WAN arrival process Heavy-tail process u u 5/18/2009 Telnet package Self-similar process u n Telnet connection Ftp control connection Ftp data transfer FINA'09
Statistical Analysis n Gaussian or not? n 5/18/2009 No!!!! FINA'09
Statistical Analysis n Gaussian mixture model n EM Algorism 5/18/2009 FINA'09
Statistical Analysis n EM Algorism n E-step n M-step 5/18/2009 FINA'09
Statistical Analysis 5/18/2009 FINA'09
Statistical Analysis n Amount of Gaussian in the model? Gaussian 5 5/18/2009 Gaussian 10 FINA'09 Gaussian 25
Statistical Analysis n Tome cost related with the amount of Gaussian in the model Not necessarily the more the better 5/18/2009 FINA'09
Time Series Analysis n n n Up Bound Low Bound Approach(for comparison) Cross indicator approach with k line and d line Moving Average Convergence and Divergence 5/18/2009 FINA'09
Time Series Analysis n Up Bound Low Bound Approach(for compare) 5/18/2009 FINA'09
Time Series Analysis n Cross indicator approach with k line and d line 5/18/2009 FINA'09
Time Series Analysis n Moving Average Convergence and Divergence 5/18/2009 FINA'09
Time Series Analysis n Experiment result comparison 5/18/2009 FINA'09
Conclusion n n Gaussian mixture model match the distribution of network traffic The Gaussian mixture model with Gaussian amount 10 is a good tradeoff between the performance and time cost K line and D line approach with low time cost but too sensitive to the fluctuation Moving Average Convergence and Diverge approach has the best performance but cost more than the K line and D line approach 5/18/2009 FINA'09
Future Work n Analysis the relation between the result and different kinds of attack and anomaly n n An auto-adaptable approach with n n Distinguish the anomaly type no need to configure the parameter of the model An model applicable for the wireless network n 5/18/2009 To meet the hybrid, unstable and wireless network with the changing topology FINA'09
Thanks for Your Attention 5/18/2009 FINA'09
- Slides: 19