By Topic

A flow-based anomaly detection method using entropy and multiple traffic features

Sign In

Cookies must be enabled to login.After enabling cookies , please use refresh or reload or ctrl+f5 on the browser for the login options.

Formats Non-Member Member
$31 $13
Learn how you can qualify for the best price for this item!
Become an IEEE Member or Subscribe to
IEEE Xplore for exclusive pricing!
close button

puzzle piece

IEEE membership options for an individual and IEEE Xplore subscriptions for an organization offer the most affordable access to essential journal articles, conference papers, standards, eBooks, and eLearning courses.

Learn more about:

IEEE membership

IEEE Xplore subscriptions

5 Author(s)
Shuying Chang ; State Key Lab. of Networking & Switching Technol., Beijing Univ. of Posts & Telecommun., Beijing, China ; Xuesong Qiu ; Zhipeng Gao ; Feng Qi
more authors

Network traffic anomaly detection is an important component in network security and management domains which can help to improve availability and reliability of networks. This paper proposes a flow-based anomaly detection method with the help of entropy. Using IPFIX, flow records containing multiple traffic features are collected in each time window. With entropy, joint probability space for multiple traffic features is constructed which is the basis of the proposed scheme. The anomaly detection method is composed of two stages. The first stage is to systematically construct the probability distribution of traffic features in normal traffic pattern. In the second stage, to detect abnormal network activities, the improved Kullback-Leibler distance between the observed probability distribution for the multiple traffic features and the forecast distribution which can be achieved by Holt-Winters technique is calculated. The improved Kullback-Leibler distance is a calculation that measures the level of difference of two probability distributions. When the distance exceeds a pre-set threshold, alerts will be generated. Finally, the scheme is demonstrated by experiment and the result shows that this method has high accuracy and low complexity.

Published in:

Broadband Network and Multimedia Technology (IC-BNMT), 2010 3rd IEEE International Conference on

Date of Conference:

26-28 Oct. 2010