Flow Anomaly Detection in Firewalled Networks

Chapple, Michael J.; Wright, Timothy; Winding, Robert

doi:10.1109/seccomw.2006.359576

Cited by 10 publications

(7 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The acceleration of agent i is ) (t ac i which is at iteration t. The last variable is gbest which is the best solution. The positions of agents are updated after each iteration as in (10). The process of updating velocity and positions is stopped when the end criterion is met [15].…”

Section: A Cuckoo Optimization Algorithmmentioning

confidence: 99%

See 1 more Smart Citation

Metaheuristic algorithms based Flow Anomaly Detector

Jadidi

Muthukkumarasamy

Sithirasenan

2013

2013 19th Asia-Pacific Conference on Communications (APCC)

View full text Add to dashboard Cite

Increasing throughput of modern high-speed networks needs accurate real-time Intrusion Detection System (IDS). A traditional packet-based Network IDS (NIDS) is timeintensive as it inspects all packets. A flow-based anomaly detector addresses scalability issues by monitoring only packet headers.This method is capable of detecting unknown attacks in high speed networks. An Artificial Neural Network (ANN) is employed in this research to detect anomalies in flow-based traffic. Metaheuristic optimization algorithms have the potential to achieve global optimal solution. In this paper, two metaheuristic algorithms, Cuckoo and PSOGSA, are examined to optimize the interconnection weights of a Multi-Layer Perceptron (MLP) neural network. This optimized MLP is evaluated with two different flow-based data sets. We then compare the performance of these algorithms. The results show that Cuckoo and PSOGSA algorithms enable high accuracy in classifying benign and malicious flows. However, the Cuckoo has lower training time.

show abstract

Section: A Cuckoo Optimization Algorithmmentioning

confidence: 99%

“…Data mining and visualization are combined in [9] to propose a flow-based botnet detection system. Statistical techniques are deployed in another paper to provide real-time anomaly detection in network flows in a controlled environment [10]. The statistically modeled patterns can be deployed for the prediction of activities.…”

Section: Introductionmentioning

confidence: 99%

Metaheuristic algorithms based Flow Anomaly Detector

Jadidi

Muthukkumarasamy

Sithirasenan

2013

2013 19th Asia-Pacific Conference on Communications (APCC)

View full text Add to dashboard Cite

show abstract

“…In this approach, the common properties of network packets are analyzed instead of the packet contents. The advantage of flow-based approaches is that only a fraction of network data is analyzed to detect the attacks [3][4][5].…”

Section: Introductionmentioning

confidence: 99%

Intrusion detection in network flows based on an optimized clustering criterion

Karimpour¹,

Lotfi²,

Siahmarzkooh³

2017

Turk J Elec Eng & Comp Sci

View full text Add to dashboard Cite

Abstract:Graph-based intrusion detection approaches consider the network as a graph and detect anomalies based on graph metrics. However, most of these approaches succumb to the cluster-based behavior of the anomalies. To resolve this problem in our study, we use flow and graph-clustering concepts to create a data set first. A new criterion related to the average weight of clusters is then defined and a model is proposed to detect attacks based on the above-mentioned criterion. Finally, the model is evaluated using a DARPA data set. Results show that the proposed approach detects the attacks with high accuracy relative to methods described in previous studies.

show abstract

“…Different methods have been used in developing flowbased anomaly detection systems such as support vector machine (SVM) [3], hidden Markov model [5], selforganising map (SOM) neural network [6], modified random-mutation hill-climbing and C4.5 (MRMHC-C4.5) algorithm [7], frequent pattern mining algorithm [8], data mining and visualization [9], statistical techniques [10], chi-square technique [11], semi-supervised methods [12], and artificial neural networks (ANNs), e.g. multilayer perceptron (MLP) [13].…”

Section: Introductionmentioning

confidence: 99%

Performance of Flow-based Anomaly Detection in Sampled Traffic

Jadidi¹,

Muthukkumarasamy²,

Sithirasenan³

et al. 2016

JNW

View full text Add to dashboard Cite

In recent years, flow-based anomaly detection has attracted considerable attention from many researchers and some methods have been proposed to improve its accuracy. However, only a few studies have considered anomaly detection with sampled flow traffic, which is widely used for the management of high-speed networks. This gap is addressed in this study. First, we optimize an artificial neural network (ANN)-based classifier to detect anomalies in flow traffic. The results show that although it has a high degree of accuracy, the classifier loses significant information in the process of sampling. In this regard, we propose a sampling method to improve the performance of flow-based anomaly detection in sampled traffic. While existing sampling methods for anomaly detection preserve only small malicious flows, the proposed algorithm samples both small and large malicious flows. Therefore, the detection rate of the flow-based anomaly detector is improved by about 5% using our algorithm. To evaluate the proposed sampling method, three flow-based datasets are generated in this study.

show abstract

Flow Anomaly Detection in Firewalled Networks

Cited by 10 publications

References 11 publications

Metaheuristic algorithms based Flow Anomaly Detector

Metaheuristic algorithms based Flow Anomaly Detector

Intrusion detection in network flows based on an optimized clustering criterion

Performance of Flow-based Anomaly Detection in Sampled Traffic

Contact Info

Product

Resources

About