Loading...
Please wait, while we are loading the content...
Similar Documents
An Empirical Evaluation of Entropy-based Anomaly Detection (2007)
| Content Provider | CiteSeerX |
|---|---|
| Author | Nychis, George Zhang, Hui Andersen, David G. |
| Abstract | There is considerable interest in using entropy-based analysis of traffic feature distributions for anomaly detection. Entropy-based metrics are appealing since they provide more fine-grained insights into traffic structure than traditional traffic volume analysis. While previous work has demonstrated the benefits of using the entropy of different traffic distributions in isolation to detect anomalies, there has been little effort in comprehensively understanding the detection power provided by entropy-based analysis of multiple traffic distribution used in conjunction with each other. We compare and contrast the anomaly detection capabilities provided by different entropybased metrics. We consider two classes of distributions: flow-header features (IP addresses, ports, and flow-sizes), and behavioral features (out- and in-degree of hosts measuring the number of distinct destination/source IP addresses that each host communicates with). Somewhat surprisingly, we observe that the entropy of the address and port distributions are strongly correlated with each other, and also detect very similar anomalies in our traffic trace. The behavioral and flow size distributions appear less correlated and detect incidents that do not show up as anomalies among |
| File Format | |
| Publisher Date | 2007-01-01 |
| Access Restriction | Open |
| Subject Keyword | Entropy-based Anomaly Detection Empirical Evaluation Entropy-based Analysis Fine-grained Insight Multiple Traffic Distribution Traffic Feature Distribution Considerable Interest Traditional Traffic Volume Analysis Anomaly Detection Flow-header Feature Flow Size Distribution Detection Power Traffic Trace Different Traffic Distribution Port Distribution Behavioral Feature Anomaly Detection Capability Distinct Destination Source Ip Similar Anomaly Detect Incident Traffic Structure Entropy-based Metric Little Effort Different Entropybased Metric |
| Content Type | Text |
