Detecting anomalous traffic in the controlled network based on cross entropy and support vector machine

Abstract

Network anomaly detection is an effective way for analysing and detecting malicious attacks. However, the typical anomaly detection techniques cannot perform the desired effect in the controlled network just as in the general network. In the circumstance of the controlled network, the detection performance will be lowered due to its special characteristics including the stronger regularity, higher dimensionality and subtler fluctuation of its traffic. On the motivation, the study proposes a novel classifier framework based on cross entropy and support vector machine (SVM). The technique first subtracts the representative traffic characteristics from the network traffic and defines a 7-tuple feature vector for the controlled network by extending the traditional 5-tuple representation of the usual network. Then the probability distributions and cross entropies of the 7 tuples are calculated during the defined statistical window so as to generate the 7-tuple cross-entropy feature vector for profiling the network traffic fluctuation in the controlled network. Finally, the multi-class SVM classifier is trained by importing the 7-tuple cross-entropy feature vectors. Experimental results show that the proposed classifier can achieve higher detection rates and is more suitable to be used in the controlled network than the typical detection techniques. Nomenclature S ip source address of the network session S port source port of the network session D ip destination address of the network session D port destination port of the network session In number of source nodes that is connecting with the observed node in the network session Out number of destination nodes that the observed node is connected within the network session Vel corresponding traffic rates of the different connections in the network session

Detection and Mitigation of DoS and DDoS Attacks in IoT-Based Stateful SDN: An Experimental Approach

“…Some information theory-based metrics are particularly popular in the detection of (D)DoS attacks. In information theory, Shannon's entropy [29] is a measure of uncertainty associated with a random variable and it is assumed as one of the most effective methods for detecting abnormal traffic [30,31].…”

An Algorithm for Detection of Traffic Attribute Exceptions Based on Cluster Algorithm in Industrial Internet of Things

“…Reference [20] proposed a detection method based on the k-means algorithm with information entropy. This method calculates data features based on the entropy value, compares normal data with unknown data, and makes judgments based on the comparative analysis.…”

Malicious Traffic classification using Long Short-Term Memory (LSTM) model

“…They use the C-means clustering and fuzzy interpolation algorithm to effectively detect the intrusion in the network. Han [2] proposed the system to detect the anomalous traffic in the network controller. The authors use the novel classifier technics to detect the intrusion in the controller network devices.…”