Attack Detection Approach by Packet Analysis Using Online Learning with Kernel Method and Correlation Change Method

Abstract

Recently, information systems are used in schools and companies and have become essential to work. However, cyber-attacks, such as stealing confidential information, stopping systems and tampering with information, pose risks. Thus, an anomaly detection and misuse detection based on machine learning and statistical methods for network monitoring is used as countermeasures against cyber-attacks. In this paper, we propose two methods to attack detection. One is an attack detection method using an online learning method. The other is an attack detection method using a structural change detection method. If abnormal traffic is monitored and discovered quickly, we can implement countermeasures before confidential information is stolen and serves are stopped. First, in this research, we propose a system using an online learning method that applies the kernel method to the intrusion detection problem. The outline of the proposed method and the learning algorithm are described. To verify of our proposed method, we conducted an experiment and discussed the results. Next, the proposed structural change detection method attempts to use structural changes to detect cyber-attacks. In addition, we propose an anomaly detection method to detect collapsed correlation via an attack on a network by structural change detection, where HTTP-DNS and syn-ack pairs are used as attributes. We conducted an experiment to evaluate the proposed structural change detection method. As a result, security can be reinforced relatively to availability and confidentiality. • (Method 1): A method of binary classification of attack communication and normal communication • (Method 2): An anomaly detection method that defines normal state from normal communication and detects from the departure from the normal state