Using Generalized Entropies and OC-SVM with Mahalanobis Kernel for Detection and Classification of Anomalies in Network Traffic

Abstract

Network anomaly detection and classification is an important open issue in network security. Several approaches and systems based on different mathematical tools have been studied and developed, among them, the Anomaly-Network Intrusion Detection System (A-NIDS), which monitors network traffic and compares it against an established baseline of a "normal" traffic profile. Then, it is necessary to characterize the "normal" Internet traffic. This paper presents an approach for anomaly detection and classification based on Shannon, Rényi and Tsallis entropies of selected features, and the construction of regions from entropy data employing the Mahalanobis distance (MD), and One Class Support Vector Machine (OC-SVM) with different kernels (Radial Basis Function (RBF) and Mahalanobis Kernel (MK)) for "normal" and abnormal traffic. Regular and non-regular regions built from "normal" traffic profiles allow anomaly detection, while the classification is performed under the assumption that regions corresponding to the attack classes have been previously characterized. Although this approach allows the use of as many features as required, only four well-known significant features were selected in our case. In order to evaluate our approach, two different data sets were used: one set of real traffic obtained from an Academic Local Area Network (LAN), and the other a subset of the 1998 MIT-DARPA Entropy 2015, 17 6240 set. For these data sets, a True positive rate up to 99.35%, a True negative rate up to 99.83% and a False negative rate at about 0.16% were yielded. Experimental results show that certain q-values of the generalized entropies and the use of OC-SVM with RBF kernel improve the detection rate in the detection stage, while the novel inclusion of MK kernel in OC-SVM and k-temporal nearest neighbors improve accuracy in classification. In addition, the results show that using the Box-Cox transformation, the Mahalanobis distance yielded high detection rates with an efficient computation time, while OC-SVM achieved detection rates slightly higher, but is more computationally expensive.

On Entropy in Network Traffic Anomaly Detection

“…The window sizes most commonly used are: 5 min [15,16,[23][24][25], 30 min, 1 min, 100 sec, 5 sec and 0.5 sec. Some researchers use windows with a fixed length L = 4096 [19], 1000 [26], and 32 [4] packets. Therefore, the main objective of windowing is to reduce the data volume.…”

“…Santiago-Paz et al (2014) [19] present the Entropy and Mahalanobis Distance (EMD) based Algorithm to define elliptical regions in the feature space. In [4], OC-SVM and k-temporal nearest neighbors are used to improve accuracy in classification.…”

“…A generic architecture of entropy-based A-NIDS is presented in figure 1, see [4]. It usually consists of two stages: the training and the testing stage.…”

Product Design Time Forecasting by Kernel-Based Regression with Gaussian Distribution Weights

“…Model selection is to seek proper values of hyper-parameters commonly by means of cross-validation and grid search [32]. The k-fold cross-validation [12,13] partitions the training data into k disjoint subsets of approximately equal size. A series of k models are then trained, each using a different combination of k´1 subsets.…”

“…Recently, kernel methods have been identified as one of the leading means for pattern classification and function approximation, and successfully applied in various fields [8][9][10][11][12][13][14]. Support vector machine (SVM), initially developed by Vapnik for pattern classification, is one of the most used models.…”