An improvement of the state-of-the-art covariance-based methods for statistical anomaly detection algorithms. Issue 4 (April 2016)

• Record Type: Journal Article
• Authors: Fortunati, Stefano; Gini, Fulvio; Greco, Maria; Farina, Alfonso; Graziano, Antonio; Giompapa, Sofia
• Is Part Of: Signal, image and video processing. Volume 10:Issue 4(2016)
• Page Start: 687
• Page End: 694
• Publication Date: 2016-04
• Subjects: Intrusion detection system -- Statistical anomaly detection -- Covariance matrix -- Flooding attacks; Signal processing -- Digital techniques -- Periodicals; Image processing -- Digital techniques -- Periodicals; Digital video -- Periodicals; 621.3822
• DOI: 10.1007/s11760-015-0796-y
• Languages: English
• ISSNs: 1863-1703

Abstract

Abstract This paper presents a possible improvement to one of the main statistical anomaly detection algorithms for cyber security applications, i.e., the covariance-based method. This algorithm employs covariance matrices to build a norm profile of the normal network traffic and to detect anomalous activities in the data flow. In order to improve the detection capabilities of this algorithm, we propose a modified version of the statistical decision rule based on a generalized version of the Chebyshev inequality for random vectors. The performance of the proposed algorithm is evaluated and compared, in terms of ROC (receiver operating characteristic) curves with the ones of the state-of-the-art covariance-based algorithm.