...
  • 主题
高级搜索  >
历史搜索 清空历史
首页> 外文期刊>IEEE Transactions on Signal Processing >A Novel Approach to Detection of Intrusions in Computer Networks via Adaptive Sequential and Batch-Sequential Change-Point Detection Methods
【24h】

A Novel Approach to Detection of Intrusions in Computer Networks via Adaptive Sequential and Batch-Sequential Change-Point Detection Methods

机译：通过自适应顺序和批处理顺序变化点检测方法检测计算机网络入侵的新方法

获取原文
获取原文并翻译 | 示例
           
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

Large-scale computer network attacks in their final stages can readily be identified by observing very abrupt changes in the network traffic. In the early stage of an attack, however, these changes are hard to detect and difficult to distinguish from usual traffic fluctuations. Rapid response, a minimal false-alarm rate, and the capability to detect a wide spectrum of attacks are the crucial features of intrusion detection systems. In this paper, we develop efficient adaptive sequential and batch-sequential methods for an early detection of attacks that lead to changes in network traffic, such as denial-of-service attacks, worm-based attacks, portscanning, and man-in-the-middle attacks. These methods employ a statistical analysis of data from multiple layers of the network protocol to detect very subtle traffic changes. The algorithms are based on change-point detection theory and utilize a thresholding of test statistics to achieve a fixed rate of false alarms while allowing us to detect changes in statistical models as soon as possible. There are three attractive features of the proposed approach. First, the developed algorithms are self-learning, which enables them to adapt to various network loads and usage patterns. Secondly, they allow for the detection of attacks with a small average delay for a given false-alarm rate. Thirdly, they are computationally simple and thus can be implemented online. Theoretical frameworks for detection procedures are presented. We also give the results of the experimental study with the use of a network simulator testbed as well as real-life testing for TCP SYN flooding attacks.
机译：通过观察网络流量的非常突然的变化，可以很容易地识别出处于最后阶段的大规模计算机网络攻击。但是，在攻击的早期阶段，这些变化很难检测，也很难与通常的流量波动区分开。快速响应，最低误报率以及检测各种攻击的能力是入侵检测系统的关键功能。在本文中，我们开发了有效的自适应顺序和批处理顺序方法，以及早发现导致网络流量变化的攻击，例如拒绝服务攻击，基于蠕虫的攻击，端口扫描和人工操作-中间攻击。这些方法对来自网络协议多层的数据进行统计分析，以检测非常细微的流量变化。该算法基于变化点检测理论，并利用测试统计的阈值来达到固定的误报率，同时允许我们尽快检测统计模型中的变化。提议的方法具有三个吸引人的特征。首先，开发的算法是自学习的，这使它们能够适应各种网络负载和使用模式。其次，对于给定的虚警率，它们允许以较小的平均延迟检测攻击。第三，它们计算简单，因此可以在线实现。提出了检测程序的理论框架。我们还通过使用网络模拟器测试平台以及针对TCP SYN泛洪攻击的真实测试来给出实验研究的结果。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号