An Investigation of Power Law Probability Distributions for Network Anomaly Detection
MetadataShow full item record
It has been previously determined that SYN packet inter arrival times are conformant with Benford’s law, which predicts the frequency of the leading digits in naturally occurring collections of numbers, and suggested that conformity or non-conformity to Benford’s law could be used to detect network anomalies. This paper expands upon that suggestion by making three contributions. First, we verify that conformity to Benford’s law of inter arrival times is also true for certain types of both TCP and UDP packets. Second, we discover that packet length could also be another alternative to inter arrival times, with the advantage that it follows both Benford’s and Zipf’s laws, implying its reliability in detecting network traffic anomaly. Finally, we explore the potential application of power laws in the specific detection of denial-of-service (DoS) attacks using both inter arrival times and packet length. Extensive experiments on the MAWI benchmark dataset and two additional datasets support our claims and demonstrate that whilst Benfordian analysis of inter arrival times can identify DoS attacks, the combination of Benfordian and Zipfian analysis of packet length gives more reliable detection.
Showing items related by title, author, creator and subject.
LCART: Lightweight Congestion Aware Reliable Transport Protocol for WSN Targeting Heterogeneous TrafficSharif, Atif; Potdar, Vidyasagar; Rathnayaka, Dinusha (2010)This paper presents energy ecient transport layer protocol for heterogeneous WSN, named as LCART. LCART fuses the prevalent or reciprocal functionalities of Transport, MAC and Wireless-Physical layers in order to achieve ...
Sharif, Atif; Potdar, Vidyasagar; Rathnayaka, Dinusha (2010)Lightweight Congestion Aware Reliable Transport protocol (LCART) is based on cross-layering the prevalent or reciprocal functionalities of Transport, MAC and Wireless-Physical layers in order to achieve energy efficiency ...
Chai, Pey San Nancy (2011)Backhaul networks are used to interconnect access points and further connect them to gateway nodes which are located in regional or metropolitan centres. Conventionally, these backhaul networks are established using ...