Abstract
Detecting multiple network attacks is essential to intrusion detection, network security defense and network traffic management. This paper presents a covariance matrix based detection approach to detecting multiple known and unknown network anomalies. It utilizes the difference of covariance matrices among observed samples in the detection. A threshold matrix is employed in the detection where each entry of the matrix evaluates the covariance changes of the corresponding features. As case studies, extensive experiments are conducted to detect multiple DoS attacks – the prevalent Internet anomalies. The experimental results indicate that the proposed approach achieves high detection rates in detecting multiple known and unknown anomalies.
This is a preview of subscription content, log in via an institution to check access.
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
References
Feinstein, L., Schnackenberg, D.: Statistical Approaches to DDoS Attack Detection and Response. In: Proceedings of the DARPA Information Survivability Conference and Expostion (DISCEX 2003) (April 2003)
Manikopoulos, C., Papavassiliou, S.: Network Intrusion and Fault Detection: A Statistical Anomaly Approach. IEEE Communications Magazine (October 2002)
Blazek, R.B., Kim, H., Rozovskii, B., Tartakovsky, A.: A Novel Approach to Detection of Denial-of-Service Attacks Via Adaptive Sequential and Batch-Sequential Change-Point Detection Methods. In: Workshop on Statistical and Machine Learning Techniques in Computer Intrusion Detection (June 2002)
Conte, E., De Maio, A., Ricci, G.: Covariance matrix estimation for adaptive CFAR detection in compound-Gaussian clutter. IEEE Transactions on Aerospace and Electronic Systems 38(2) (April 2002)
Yang, Z., Wang, X.: Blind turbo multiuser detection for long-code multipath CDMA. IEEE Transactions on Communications 50(1) (January 2002)
Conte, E., Maio, A.D., Ricci, G.: Recursive estimation of the covariance matrix of a compound-Gaussian process and its application to adaptive CFAR detection. IEEE Transactions on Signal Processing 50(8) (August 2002)
Ye, N., Emran, S., Chen, Q., Vilbert, S.: Multivariate Statistical Analysis of Audit Trails for Host-Based Intrusion Detection. IEEE Transaction on Computers 51(7) (2002)
Cormode, G., Muthukrishnan, S.: What’s New: Finding Significant Differences in Network Data Streams. In: IEEE INFOCOM 2004 (March 2004)
Estan, C., Varghese, G.: Data streaming in computer networks. In: Proceedings of workshop on Management and processing of Data Streams (2003), http://www.research.att.com/conf/mpds2003/schedule/estanV.ps
Jin, S., Yeung, D.: A Covariance Analysis Model for DDoS Attack Detection. In: Proceedings of IEEE ICC 2004, Paris, France (June 2004)
Lincoln Laboratories: 1999 DARPA Intrusion Detection Evaluation (1999), http://www.ll.mit.edu/IST/ideval/index.html
Lee, W.: A Data Mining Framework for Constructing Features and Models for Intrusion Detection Systems. Ph.D. dissertation, Columbia University (1999)
Lee, W., Stolfo, S.: A Framework for Constructing Features and Models for Intrusion Detection Systems. ACM Trans. Information and System Security 3(4), 227–261 (2000)
Mahoney, M.V., Chan, P.K.: An Analysis of the 1999 DARPA/Lincoln Laboratory Evaluation Data for Network Anomaly Detection. In: RAID, pp. 220–237 (2003)
Jin, S., Yeung, D., Wang, X., Tsang, E.C.C.: A Second-order Statistical Detection Approach with Application to Internet Anomaly Detection. In: IEEE International Conference on Machine Learning and Cybernetics (August 2005)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2006 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Jin, S., Yeung, D.S., Wang, X., Tsang, E.C.C. (2006). A Covariance Matrix Based Approach to Internet Anomaly Detection. In: Yeung, D.S., Liu, ZQ., Wang, XZ., Yan, H. (eds) Advances in Machine Learning and Cybernetics. Lecture Notes in Computer Science(), vol 3930. Springer, Berlin, Heidelberg. https://doi.org/10.1007/11739685_72
Download citation
DOI: https://doi.org/10.1007/11739685_72
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-33584-9
Online ISBN: 978-3-540-33585-6
eBook Packages: Computer ScienceComputer Science (R0)