Combining statistical and spectral analysis techniques in network traffic anomaly detection

Novakov, Stevan

doi:10.22215/etd/2012-07033

Cited by 3 publications

(4 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For brevity, the paper only shows some of the results for short attack length and low infection rate. Detailed results can be found in Novakov (2012).…”

Section: Resultsmentioning

confidence: 99%

A Hybrid Technique Using PCA and Wavelets in Network Traffic Anomaly Detection

Novakov

Lung

Lambadaris

et al. 2014

International Journal of Mobile Computing and Multimedia Communications

View full text Add to dashboard Cite

Research into network anomaly detection has become crucial as a result of a significant increase in the number of computer attacks. Many approaches in network anomaly detection have been reported in the literature, but data or solutions typically are not freely available. Recently, a labeled network traffic flow dataset, Kyoto2006+, has been created and is publicly available. Most existing approaches using Kyoto2006+ for network anomaly detection apply various clustering techniques. This paper leverages existing well known statistical analysis and spectral analysis techniques for network anomaly detection. The first popular approach is a statistical analysis technique called Principal Component Analysis (PCA). PCA describes data in a new dimension to unlock otherwise hidden characteristics. The other well known spectral analysis technique is Haar Wavelet filtering analysis. It measures the amount and magnitude of abrupt changes in data. Both approaches have strengths and limitations. In response, this paper proposes a Hybrid PCA–Haar Wavelet Analysis. The hybrid approach first applies PCA to describe the data and then Haar Wavelet filtering for analysis. Based on prototyping and measurement, an investigation of the Hybrid PCA–Haar Wavelet Analysis technique is performed using the Kyoto2006+ dataset. The authors consider a number of parameters and present experimental results to demonstrate the effectiveness of the hybrid approach as compared to the two algorithms individually.

show abstract

“…For brevity, the paper only shows some of the results for short attack length and low infection rate. Detailed results can be found in Novakov (2012).…”

Section: Resultsmentioning

confidence: 99%

A Hybrid Technique Using PCA and Wavelets in Network Traffic Anomaly Detection

Novakov

Lung

Lambadaris

et al. 2014

International Journal of Mobile Computing and Multimedia Communications

View full text Add to dashboard Cite

show abstract

“… to decompose input signal into piecewise constant signal. Novakov in[11] presents a spectral analysis technique for anomaly detection in network traffic.…”

mentioning

confidence: 99%

Review of Modern Methods of Network Traffic Analysis

Djeguede¹,

Salpagarov²

2022

МАТЕРИАЛЫ IX-й Международной Научной Конференции «МАТЕМАТИЧЕСКОЕ И ПРОГРАММНОЕ ОБЕСПЕЧЕНИЕ ИНФОРМАЦИОННЫХ, ТЕХНИЧЕСКИХ И ЭКОНОМ

View full text Add to dashboard Cite

“…We contaminated time bins 25, 45 and 60. The suspicious bin that algorithm detected were: 45, 25,60,14,13,30,24,67,12,16. We can see that IPCA detects these 3 anomalies in the first three iterations.…”

Section: Experiments 1: Contaminating the Traces With Three Tcp Scansmentioning

confidence: 85%

“…They showed that PCA can effectively separate the false alarms from the real network anomalies in real time and identify the flows that cause the anomaly. Novakov et al [30] suggest a hydrid PCA approach that combines the PCA statistical analysis with a spectral analysis technique based on Haar wavelets. The PCA can be easily understood from a simple example.…”

Section: Related Workmentioning

confidence: 99%

Iterative Principal Component Analysis (IPCA) for Network Anomaly Detection

Delimargas¹

View full text Add to dashboard Cite

Due to a plethora of network anomalies and their rapid increase both in complexity and diversity, an ongoing research for security countermeasures is emerging. Principal Component Analysis (PCA) is one of the several methods that were suggested in order to detect such anomalies and is known as a powerful tool in finding and diagnosing anomalies in network traffic. Nonetheless, previous relevant research work highlighted some inconsistencies of the classical method. It has been shown that the efficiency of the results are highly dependent to the input data and the calibration of its parameters. These parameters should be carefully selected in order to pinpoint the existence of anomalies in network traffic. By obtaining real network traffic traces from a small enterprise and artificially injecting anomalies, we apply a modified PCA based method. The results of our experimentation imply that this method possesses promising capabilities in efficiently detecting network anomalies and manages to surpass some of the limitations of the classic approach. v

show abstract

Combining statistical and spectral analysis techniques in network traffic anomaly detection

Cited by 3 publications

References 19 publications

A Hybrid Technique Using PCA and Wavelets in Network Traffic Anomaly Detection

A Hybrid Technique Using PCA and Wavelets in Network Traffic Anomaly Detection

Review of Modern Methods of Network Traffic Analysis

Iterative Principal Component Analysis (IPCA) for Network Anomaly Detection

Contact Info

Product

Resources

About