Intrusion detection in a private network by satisfying constraints

With the advancement of newer technologies, the frequency of malicious attacks is growing rapidly. Even private networks without external connections cannot hide from these attacks. Constant monitoring of the network is a vital element of an organization's security system. Among many monitoring techniques, network behavior analysis has become a common practice. Restricted private networks are characterized by a limited number of protocols. The normal traffic pattern of a network can be modeled as network constraints. Violation of any of these constraints indicates that an intrusion has occurred. This paper presents a novel framework to detect intrusions in a private network. We illustrate the framework with ten significant constraints on the real-time publish, subscribe and internet group management protocols. We present how the framework evaluates these constraints against traffic from an experimental network to prevent attacks.