Seventh International Conference on Networking (icn 2008)
Detection Network Anomalies Based on Packet and Flow Analysis
April 13-April 18
ISBN: 978-0-7695-3106-9
Anomalies generate vast amounts of bogus traffic, which can overwhelm the network and any attached hosts. Identifying Traffic anomalies rapidly and accurately is critical to network stability and usefulness. Most papers focus on analyzing the volume of data or packets on the network. However, legitimate network traffic may be bursty or highly variable, rendering such naive approaches ineffective[7]. We propose a novel method called MultiA to solve this problem. Rather than just looking at volumes of packets, MultiA intelligently adopted Multistage Filter and information entropy take into account the behavior of the network. The MultiA is scalable, automated and self-training. We find this technique effectively identifies network traffic anomalies while avoiding the high false alarms rate.
Index Terms:
anomaly detection, flow analysis, multistage filter
Citation:
Hong Wang, Zhenghu Gong, Qing Guan, Baosheng Wang, "Detection Network Anomalies Based on Packet and Flow Analysis," icn, pp.497-502, Seventh International Conference on Networking (icn 2008), 2008