Premium
Network anomaly detection using a cross‐correlation‐based long‐range dependence analysis
Author(s) -
AsSadhan Basil,
Alzoghaiby Abraham,
Binsalleeh Hamad,
Kyriakopoulos Konstantinos G.,
Lambotharan Sangarapillai
Publication year - 2020
Publication title -
international journal of network management
Language(s) - English
Resource type - Journals
SCImago Journal Rank - 0.373
H-Index - 28
eISSN - 1099-1190
pISSN - 1055-7148
DOI - 10.1002/nem.2129
Subject(s) - computer science , anomaly detection , range (aeronautics) , autocorrelation , data mining , correlation , anomaly (physics) , cross correlation , measure (data warehouse) , the internet , artificial intelligence , statistics , mathematics , materials science , geometry , physics , composite material , condensed matter physics , world wide web
Summary The detection of anomalies in network traffic is an important task in today's Internet. Among various anomaly detection methods, the techniques based on examination of the long‐range dependence (LRD) behavior of network traffic stands out to be powerful. In this paper, we reveal anomalies in aggregated network traffic by examining the LRD behavior based on the cross‐correlation function of the bidirectional control and data planes traffic. Specifically, observing that the conventional cross‐correlation function has a low measure of dissimilarity between the two planes, which leads to a reduced anomaly detection performance, we propose a modification of the cross‐correlation function to mitigate this issue. The performance of the proposed method is analyzed using a relatively recent Internet traffic captured at King Saud University. The results demonstrate that using the modified cross‐correlation function has the ability to detect low volume and short duration attacks. It also compensates for some misdetections exhibited by using the autocorrelation structures of the bidirectional traffic of the control, data, and WHOLE (combined control and data) planes traffic.