A Novel Abnormal Traffic Detection Method Based on Statistical Model

Abstract

An abnormal traffic detection method via statistical model is proposed in this paper. At first, a new feature of normal traffic that it represents significant one-order dependency is discovered. In other words, normal traffic is obviously positive correlative. But the feature rarely appears in abnormal traffic. Based on one-order dependency, an entropy-rate model which is highly relevant to Markov model is then introduced by this paper to detect abnormal traffic. The proposed method is independent of signature so that it is able to detection both known and unknown abnormal traffic. At last, contrast experiment shows that the proposed method outperforms current methods in terms of false positives and false negatives.