An information-theoretic method for the detection of anomalies in network traffic. Issue 70 (September 2017)

• Record Type: Journal Article
• Authors: Callegari, Christian; Giordano, Stefano; Pagano, Michele
• Is Part Of: Computers & security. Issue 70(2017)
• Page Start: 351
• Page End: 365
• Publication Date: 2017-09
• Subjects: Anomaly detection -- Information theory -- Shannon entropy -- Tsallis entropy -- Rényi entropy -- Kullback-leibler divergence -- Jensen-Shannon divergence -- MAWILab; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2017.07.004
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: Anomaly-based Intrusion Detection is a key research topic in network security due to its ability to face unknown attacks and new security threats. For this reason, many works on the topic have been proposed in the last decade. Nonetheless, an ultimate solution, able to provide a high detection rate with an acceptable false alarm rate, has still to be identified. In this paper we propose a novel intrusion detection system that performs anomaly detection by studying the variation in the entropy associated to the network traffic. To this aim, the traffic is first aggregated by means of random data structures (namely three-dimension reversible sketches) and then the entropy of different traffic descriptors is computed by using several definitions. The experimental results obtained over the MAWILab dataset validate the system and demonstrate the effectiveness of our proposal for a proper set of entropy definitions.