SCIENCE@home

Dynamic Modeling of Internet Traffic for Intrusion Detection

K. Shah,E. Jonckheere,S. Bohacek

Published 2002 in Proceedings of the 2002 American Control Conference (IEEE Cat. No.CH37301)

ABSTRACT

Computer network traffic is analyzed via mutual information techniques, implemented using linear and nonlinear canonical correlation analyses, with the specific objective of detecting UDP flooding attacks. NS simulation of HTTP, FTP, and CBR traffic shows that flooding attacks are accompanied by a change of mutual information, either at the link being flooded or at another upstream or downstream link. This observation appears to be topology independent, as the technique is demonstrated on the so-called parking-lot topology, random 50-node topology, and 100-node transit-stub topology. This technique is also employed to detect UDP flooding with low false alarm rate on a backbone link. These results indicate that a change in mutual information provides a useful detection criterion when no other signature of the attack is available.

PUBLICATION RECORD

  • Publication year

    2002

  • Venue

    Proceedings of the 2002 American Control Conference (IEEE Cat. No.CH37301)

  • Publication date

    2002-05-08

  • Fields of study

    Computer Science, Engineering

  • Identifiers
    DOI 10.1109/ACC.2002.1024008
  • External record

    Open on Semantic Scholar

  • Source metadata

    Semantic Scholar

CITATION MAP

EXTRACTION MAP

CLAIMS

  • No claims are published for this paper.

CONCEPTS

  • No concepts are published for this paper.

REFERENCES

Showing 1-58 of 58 references · Page 1 of 1

CITED BY

Showing 1-20 of 20 citing papers · Page 1 of 1