Automatic Detection of Computer Network Traffic Anomalies based on Eccentricity Analysis

Abstract

In this paper, we propose an approach to automatic detection of attacks on computer networks using data that combine the traffic generated with 'live' intra-cloud virtual-machine (VM) migration. The method used in this work is the recently introduced typicality and eccentricity data analytics (TEDA) framework. We compare the results of applying TEDA with the traditionally used methods such as statistical analysis, such as k-means clustering. One of the biggest challenges in computer network analysis using statistical or numerical methods is the fact that the protocol information is composed of integer/string values and, thus, not easy to handle by traditional pattern recognition methods that deal with real values. In this study we consider as features the tuple {IP source, IP destination, Port source and Port destination} extracted from the network flow data in addition to the traditionally used real values that represent the number of packets per time or quantity of bytes per time. Using entropy of the IP data helps to convert the integer raw data into real valued signatures. The proposed solution permit to build a real-time anomaly detection system and reduce the number of information that is necessary for evaluation. In general, the systems based on traffic are fast and are used in real time but they do not produce good results in attacks that produce a flow hidden within the background traffic or within a high traffic that is produced by other application. We validate our approach an a dataset which includes attacks on the network port scan (NPS) and network scan (NS) that permit hidden flow within the normal traffic and see this attacks together with live migration which produces a higher traffic flow.

Hardware Architecture Proposal for TEDA Algorithm to Data Streaming Anomaly Detection

“…Besides, it has been shown that due to the recursion feature, TEDA is computationally more efficient and suitable for online and real-time applications. Other works in the literature also present similar results and conclusions [8], [10], [12], [27], [28]. The characteristics and advantages of the TEDA algorithm presented in these references have justified and motivated the choice of this algorithm, among several anomaly detection algorithms, for the implementation of the hardware architecture for streaming processes.…”

An Evolving TinyML Compression Algorithm for IoT Environments Based on Data Eccentricity

“…In the following subsections, the main mathematical concepts behind the methodology are shown and what makes it so flexible that it can be used for the development of a variety of algorithms, such as: anomalies and failure detection [ 49 ], image processing, clustering [ 50 , 51 ], classification [ 52 ], regression [ 53 ], forecast, control, filtering, big data [ 54 ], and traffic analysis [ 55 ], among others.…”

Hardware Architecture Proposal for TEDA algorithm to Data Streaming Anomaly Detection

“…The paper published by [18] brings a study for anomaly detection in TCP / IP networks. The purpose of the paper is to detect computer network anomalies in the process of virtual machine (VM) live migration from local to cloud, by comparing this approach between TEDA, clustering K-Means, and static analysis.…”