A flow based anomaly detection system using chi-square technique

Abstract

Various tools, which are capable to evade different security mechanisms like firewall, IDS and IPS, exist and that helps the intruders for sending malicious traffic to the network or system. So, inspection of malicious traffic and identification of anomalous activity is very much essential to stop future activity of intruders which can be a possible attack. In this paper we present a flow based system to detect anomalous activity by using IP flow characteristics with chi-square detection mechanism. This system provides solution to identify anomalous activities like scan and flood attack by means of automatic behavior analysis of the network traffic and also give detailed information of attacker, victim, type and time of the attack which can be used for corresponding defense. Anomaly Detection capability of the proposed system is compared with SNORT Intrusion detection system and results prove the very high detection rate of the system over SNORT for different scan and flood attack. The proposed system detects different stealth scan and malformed packets scan. Since the probability of using stealth scan in real attack is very high, this system can identify the real attacks in the initial stage itself and preventive action can be taken.

An Ensemble of Text Convolutional Neural Networks and Multi-Head Attention Layers for Classifying Threats in Network Packets

“…Ref. [21] developed a flow-based system that detects abnormal activity by applying the chisquared technique to IP flow characteristics. Some studies have examined packet payloads.…”

Computação autonômica aplicada ao diagnóstico e solução de anomalias de redes de computadores

“…Tradicionalmente, é uma ação preliminar realizada por um atacante para descobrir vulnerabilidades no dispositivo alvo, a fim de que ela seja explorada. Com o objetivo mais abrangente, o network scan visa a descoberta de dispositivos ativos na rede coletando suas informações, tais como o sistema operacional utilizado e os serviços oferecidos por eles [51]. Na propagação de um worm, as portas dos dispositivos de rede também são sondadas [88].…”

“…As informações obtidas de cada pacote vão além do seu cabeçalho, possibilitando a inspeção do payload para identificar anomalias específicas (e.g., vírus). Este mecanismo é, contudo, muito dispendioso, pois o processamento de todos os pacotes transmitidos em grandes redes requer alta capacidade de processamento e armazenamento, inviabilizando sua utilização [51].…”