Attack Detection based on Statistical Discriminators

Attacks represent a serious threat to a network environment, and therefore need to be promptly detected. New attack types, of which detection systems may not even be aware, are the most difficult to detect. Currently, the available methods are mainly based on signature or learning algorithms and generally can not detect these new attacks. The approach presented here uses a small number of statistical discriminators and cluster analysis to detect attacks, obtaining results which are better than the results found in previous papers. Cluster analysis is a not supervised technique and, therefore, it is able to detect new attacks. We performed an empirical test using real traces.