Network anomaly detection based on R/S Pox Diagram

Akinori Takahashi; Ryuji Igarashi; Hiroshi Ueda; Yukio Iwaya; Tetsuo Kinoshita

doi:10.5188/ijsmer.17.186

Network anomaly detection based on R/S Pox Diagram

Akinori Takahashi, Ryuji Igarashi, Hiroshi Ueda, Yukio Iwaya, Tetsuo Kinoshita

Systems & Software Division

Research output: Contribution to journal › Article › peer-review

1 Citation (Scopus)

Abstract

A method is proposed in this paper to detect attack traffic or anomaly by utilizing an R/S analysis. Our study so far indicates that a LS(Level Shift) or a Cycle superimposed on a discrete time series provides a dispersion in the R/S pox diagram. The LS is well expressed by both HSup and HInf, the slope of the upperand the lower-most plots group of the pox diagram. By utilizing them as the indices of the anomaly traffic, the validity of our proposal is tested at first by a Bernoulli trial simulation and then with the traffic data of "1999 DARPA Intrusion Detection Evaluation Data Set". Tested attacks are TCP SYN Flood, UDP Storm, and Smurf and our investigations showed that HInf may become a promising parameter for the detection of flooding attacks.

Original language	English
Pages (from-to)	186-192
Number of pages	7
Journal	International Journal of the Society of Material Engineering for Resources
Volume	17
Issue number	2
DOIs	https://doi.org/10.5188/ijsmer.17.186
Publication status	Published - 2010 Sept 1

Keywords

Anomaly detection
Dos attack
Hurst parameter
Pox diagram

ASJC Scopus subject areas

Chemical Engineering(all)
Materials Science(all)
Mechanical Engineering

Access to Document

10.5188/ijsmer.17.186

Cite this

@article{8d5a3afd15dd4403b265981a582348a1,

title = "Network anomaly detection based on R/S Pox Diagram",

abstract = "A method is proposed in this paper to detect attack traffic or anomaly by utilizing an R/S analysis. Our study so far indicates that a LS(Level Shift) or a Cycle superimposed on a discrete time series provides a dispersion in the R/S pox diagram. The LS is well expressed by both HSup and HInf, the slope of the upperand the lower-most plots group of the pox diagram. By utilizing them as the indices of the anomaly traffic, the validity of our proposal is tested at first by a Bernoulli trial simulation and then with the traffic data of {"}1999 DARPA Intrusion Detection Evaluation Data Set{"}. Tested attacks are TCP SYN Flood, UDP Storm, and Smurf and our investigations showed that HInf may become a promising parameter for the detection of flooding attacks.",

keywords = "Anomaly detection, Dos attack, Hurst parameter, Pox diagram",

author = "Akinori Takahashi and Ryuji Igarashi and Hiroshi Ueda and Yukio Iwaya and Tetsuo Kinoshita",

year = "2010",

month = sep,

day = "1",

doi = "10.5188/ijsmer.17.186",

language = "English",

volume = "17",

pages = "186--192",

journal = "International Journal of the Society of Materials Engineering for Resources",

issn = "1347-9725",

publisher = "Society of Materials Engineering for Resources of Japan",

number = "2",

}

TY - JOUR

T1 - Network anomaly detection based on R/S Pox Diagram

AU - Takahashi, Akinori

AU - Igarashi, Ryuji

AU - Ueda, Hiroshi

AU - Iwaya, Yukio

AU - Kinoshita, Tetsuo

PY - 2010/9/1

Y1 - 2010/9/1

N2 - A method is proposed in this paper to detect attack traffic or anomaly by utilizing an R/S analysis. Our study so far indicates that a LS(Level Shift) or a Cycle superimposed on a discrete time series provides a dispersion in the R/S pox diagram. The LS is well expressed by both HSup and HInf, the slope of the upperand the lower-most plots group of the pox diagram. By utilizing them as the indices of the anomaly traffic, the validity of our proposal is tested at first by a Bernoulli trial simulation and then with the traffic data of "1999 DARPA Intrusion Detection Evaluation Data Set". Tested attacks are TCP SYN Flood, UDP Storm, and Smurf and our investigations showed that HInf may become a promising parameter for the detection of flooding attacks.

AB - A method is proposed in this paper to detect attack traffic or anomaly by utilizing an R/S analysis. Our study so far indicates that a LS(Level Shift) or a Cycle superimposed on a discrete time series provides a dispersion in the R/S pox diagram. The LS is well expressed by both HSup and HInf, the slope of the upperand the lower-most plots group of the pox diagram. By utilizing them as the indices of the anomaly traffic, the validity of our proposal is tested at first by a Bernoulli trial simulation and then with the traffic data of "1999 DARPA Intrusion Detection Evaluation Data Set". Tested attacks are TCP SYN Flood, UDP Storm, and Smurf and our investigations showed that HInf may become a promising parameter for the detection of flooding attacks.

KW - Anomaly detection

KW - Dos attack

KW - Hurst parameter

KW - Pox diagram

UR - http://www.scopus.com/inward/record.url?scp=84875904443&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=84875904443&partnerID=8YFLogxK

U2 - 10.5188/ijsmer.17.186

DO - 10.5188/ijsmer.17.186

M3 - Article

AN - SCOPUS:84875904443

SN - 1347-9725

VL - 17

SP - 186

EP - 192

JO - International Journal of the Society of Materials Engineering for Resources

JF - International Journal of the Society of Materials Engineering for Resources

IS - 2

ER -

Network anomaly detection based on R/S Pox Diagram

Abstract

Keywords

ASJC Scopus subject areas

Access to Document

Other files and links

Fingerprint

Cite this