A Network Misuse Detection Mechanism Based on Traffic Log

Abstract

Setting up a large number of network connections and using up a lot of bandwidth are usually regarded as a network misuse behavior. It is significance for the network supervision to find and recognize these behaviors timely and correctly. This paper proposes a network misuse detection mechanism based on traffic log, combining the payload independent traffic classification technology. Through this mechanism, we can complete the selection of behavior features, and overcome the problems for both sample insufficiency and adaptability by using collaborative learning method. The experiment result shows that the method can separate 99% of the normal types from the misuse types, and the recognition rate of various misuse types can reach 80% or so, even be above 90% for some misuse types, which meets the application demand.

A many‐objective integrated evolutionary algorithm for feature selection in anomaly detection

“…The traditional intrusion detection algorithms 4 mainly include: misuse detection and anomaly detection. Misuse detection [5][6][7] is to determine whether an event is an intrusion behavior by determining a set of rules. It has high accuracy and low false detection rate (FDR), but the deficiency is that it cannot detect unknown attacks.…”