Multivariate Correlation Analysis Technique Based on Euclidean Distance Map for Network Traffic Characterization

Abstract

Abstract. The quality of feature has significant impact on the performance of detection techniques used for Denial-of-Service (DoS) attack. The features that fail to provide accurate characterization for network traffic records make the techniques suffer from low accuracy in detection. Although researches have been conducted and attempted to overcome this problem, there are some constraints in these works. In this paper, we propose a technique based on Euclidean Distance Map (EDM) for optimal feature extraction. The proposed technique runs analysis on original feature space (first-order statistics) and extracts the multivariate correlations between the first-order statistics. The extracted multivariate correlations, namely second-order statistics, preserve significant discriminative information for accurate characterizations of network traffic records, and these multivariate correlations can be the high-quality potential features for DoS attack detection. The effectiveness of the proposed technique is evaluated using KDD CUP 99 dataset and experimental analysis shows encouraging results.

A Survey of Distance and Similarity Measures Used Within Network Intrusion Anomaly Detection

“…Besides entropy, also in the category of probability distance measures is the popular Kullback-Leibler distance (KLD), or information gain. The KLD is formulated as shown in (23), where P 1 and P 2 are probability distributions over the domain X, p 1 (x) is the probability of x occurring in P 1 , p 2 (x) is the…”

“…Eid et al [21] develop a feature selection method for Network Intrusion Detection (NID) in which the first layer uses Kullback-Leibler distance (KLD) to rank the features in the dataset. KLD, or information gain, is formulated as shown in (23), where P 1 and P 2 are probability distributions over the domain X, p 1 (x) is the probability of x occurring in P 1 , p 2 (x) is the probability of x occurring in P 2 , and a is the base in which the KLD is calculated.…”

“…Tan et al [23] generate Euclidean Distance Maps for the features of each sample in the dataset, then convert the distances in each cell of the map to a color for purposes of rapid visual comparison. The visualization showed clear differences between normal and attack samples, and provide novel characterizations of the different types of computer network traffic records.…”

A Combined Approach to DoS Attack Detection System

“…And then, our experimental results show that our approach can provide the best performance on the real network, in comparison with that by heuristic feature selection and any other single data mining approaches. Aikaterini Mitrokotsa, Christos Douligeris proposed a technique which presents an approach that detects Denial of Service attacks using Emergent Self-Organizing Maps [5]. The approach is based on classifying "normal" traffic against "abnormal" traffic in the sense of Denial of Service attacks.…”

“…In Existing system Mahalabonis Distance and covariance matrix is used but due to high time complexity in proposed system Euclidian distance [5] is used in Multivariate correlation analysis. There are basically main three algorithms are used in proposed system, namely Normal Profile generation, Attack Detection and Behavioral Rules generation algorithms.…”