E-Alarm: An Anomaly Detection System on Large Network

In recent years, several worms attacked the Internet and caused serious global damage. We consider that if we can detect the worm in its early spreading stage and perform the access control policy on the related routers immediately, the disaster may be alleviated or even avoided. E-Alarm makes use of network topology information, analyzes anomaly alarms using clustering method, and gives access control policy according to the result of analysis. Our simulation experimental results indicate that E-Alarm system indeed can detect and control the anomaly caused by worms in its early spreading period. Experimental results clearly demonstrate the efficiency of our approach to improve the accuracy of the intrusion detection and decision process.