Normal Profile Updating Method for Enhanced Packet Header Anomaly Detection

Intrusion Detection Using Statistical Classifier Based on Packet Header Analysis

“…As these old datasets primarily focused on the type of attack as a label rather than the attack itself, we decided to look for more recent works. The works done by [37] and [41] were chosen from the literature for comparison. The first work proposes a host-based PHAD (Hb-PHAD) algorithm using statistical techniques; they analyzed the ISCX-2012 dataset [7].…”

“…They claimed to have achieved a detection rate of 90.84% for their Hb-PHAD technique and a detection rate of 99.04% for their modified technique. The researchers in [41] claimed that they could accurately predict about 71.27% of packets into their appropriate class with their normal-profile updated PHAD technique.…”

“…Other works used different algorithms like PAID [39], which employs Bayesian and feature extraction methods for anomaly detection, and LNID [40]. The most recent modification for the PHAD was to update the normal profile, which the researchers did in [41]. These PHAD techniques can be applied to real-time traffic with the help of a packet sniffer tool like Wireshark [42].…”