Hubble: An End to End Approach for Anomaly Detection in Network Traffic

2021 ◽  
Author(s):  
Shiwei Wang ◽  
Haizhou Du ◽  
Lin Liu ◽  
Zhenyu Lin
Keyword(s):  
Anomaly Detection ◽  
Network Traffic ◽  
End To End

scholarly journals Promising techniques for anomaly detection on network traffic

2017 ◽  
Vol 14 (3) ◽  
pp. 597-609
Author(s):  
Hui Tian ◽  
Jingtian Liu ◽  
Meimei Ding
Keyword(s):  
Intrusion Detection ◽  
Anomaly Detection ◽  
Network Traffic ◽  
High Accuracy ◽  
Detection Methods ◽  
Accuracy Rate ◽  
Time Efficiency ◽  
End To End

In various networks, anomaly may happen due to network breakdown, intrusion detection, and end-to-end traffic changes. To detect these anomalies is important in diagnosis, fault report, capacity plan and so on. However, it?s challenging to detect these anomalies with high accuracy rate and time efficiency. Existing works are mainly classified into two streams, anomaly detection on link traffic and on global traffic. In this paper we discuss various anomaly detection methods on both types of traffic and compare their performance.

scholarly journals Entropy-based network traffic anomaly classification method resilient to deception

2021 ◽  
pp. 45-45
Author(s):  
Juma Ibrahim ◽  
Slavko Gajin
Keyword(s):  
Anomaly Detection ◽  
Network Traffic ◽  
Real Life ◽  
Classification Method ◽  
Practical Implementation ◽  
Network Environment ◽  
Detection Techniques ◽  
Basic Set ◽  
Anomaly Classification ◽  
Traffic Anomaly

Entropy-based network traffic anomaly detection techniques are attractive due to their simplicity and applicability in a real-time network environment. Even though flow data provide only a basic set of information about network communications, they are suitable for efficient entropy-based anomaly detection techniques. However, a recent work reported a serious weakness of the general entropy-based anomaly detection related to its susceptibility to deception by adding spoofed data that camouflage the anomaly. Moreover, techniques for further classification of the anomalies mostly rely on machine learning, which involves additional complexity. We address these issues by providing two novel approaches. Firstly, we propose an efficient protection mechanism against entropy deception, which is based on the analysis of changes in different entropy types, namely Shannon, R?nyi, and Tsallis entropies, and monitoring the number of distinct elements in a feature distribution as a new detection metric. The proposed approach makes the entropy techniques more reliable. Secondly, we have extended the existing entropy-based anomaly detection approach with the anomaly classification method. Based on a multivariate analysis of the entropy changes of multiple features as well as aggregation by complex feature combinations, entropy-based anomaly classification rules were proposed and successfully verified through experiments. Experimental results are provided to validate the feasibility of the proposed approach for practical implementation of efficient anomaly detection and classification method in the general real-life network environment.

scholarly journals Anomaly Detection Method Using Entropy of Network Traffic Distributions

2006 ◽  
Vol 13C (3) ◽  
pp. 283-294
Author(s):  
Koo-Hong Kang ◽  
Jin-Tae Oh ◽  
Jong-Soo Jang
Keyword(s):  
Anomaly Detection ◽  
Network Traffic ◽  
Detection Method

A Novel Network Traffic Anomaly Detection Based on Multi-Scale Fusion

2011 ◽  
Vol 48-49 ◽  
pp. 102-105
Author(s):  
Guo Zhen Cheng ◽  
Dong Nian Cheng ◽  
He Lei
Keyword(s):  
Anomaly Detection ◽  
False Alarm ◽  
False Alarm Rate ◽  
Network Traffic ◽  
Self Similarity ◽  
Data Set ◽  
Multi Scale ◽  
Traffic Anomaly ◽  
Detection Evaluation ◽  
Better Than

Detecting network traffic anomaly is very important for network security. But it has high false alarm rate, low detect rate and that can’t perform real-time detection in the backbone very well due to its nonlinearity, nonstationarity and self-similarity. Therefore we propose a novel detection method—EMD-DS, and prove that it can reduce mean error rate of anomaly detection efficiently after EMD. On the KDD CUP 1999 intrusion detection evaluation data set, this detector detects 85.1% attacks at low false alarm rate which is better than some other systems.

Sign in / Sign up

Export Citation Format

Share Document