Network traffic anomaly detection based on catastrophe theory

Abstract

Although various methods have been proposed to detect anomalies, they are mostly based on the traditional statistical physics. The traditional statistical physics methods are based on the stationary hypothesis of the network traffic, which always ignore the real catastrophe process when anomalies occur. In order to reflect the catastrophe process of the abnormal network traffic, we present a non-stationary network traffic anomaly detection approach based on catastrophe theory. The cusp catastrophe model is selected to describe the catastrophe feature of the network traffic and the catastrophe distance is defined as an index to assess the deviation from the normal catastrophe model and the serial of catastrophe distance is the main feature to detect anomaly. We evaluate our approach using the 1999 intrusion evaluation data set of network traffic trace provided by The Defense Advanced Research Projects Agency (DARPA). Experiment results show that our approach can effectively detect network anomalies and achieve high detection probability and low false alarms rate.

Applying Catastrophe Theory for Network Anomaly Detection in Cloud Computing Traffic

“…Xiong et al proposed two anomaly detection models based on catastrophe theory in network traffic [21,22]. After that, in 2014 they proposed an intrusion detection system to detect network traffic anomaly based on synergetic neural networks and the catastrophe theory to reduce security risks in the cloud network.…”

Packet Header Intrusion Detection with Binary Logistic Regression Approach in Detecting R2L and U2R Attacks

“…This data set is publicly available and was prepared by MIT Lincoln Lab. We are conscious of imperfection of DARPA dataset especially on the maturity over 15 years, but these are the most comprehensive and extensive used dataset in this field where we can easily make comparison with other researchers [18], [19], [20], [21], [22], and [23] since it has been accepted as standard benchmark for their IDS model. Lincoln Lab has provided 5 weeks of data that consist of 3 weeks of training data and 2 weeks of testing data in various formats such as tcpdump, NT audit data, and BSM solaris host audit data.…”