Show simple item record

dc.contributor.authorPrandl, S.
dc.contributor.authorLazarescu, M.
dc.contributor.authorPham, DucSon
dc.contributor.authorSoh, Sie Teng
dc.contributor.authorKak, S.
dc.date.accessioned2018-02-19T07:58:52Z
dc.date.available2018-02-19T07:58:52Z
dc.date.created2018-02-19T07:13:33Z
dc.date.issued2017
dc.identifier.citationPrandl, S. and Lazarescu, M. and Pham, D. and Soh, S.T. and Kak, S. 2017. An Investigation of Power Law Probability Distributions for Network Anomaly Detection, IEEE Security and Privacy Workshop on Traffic Measurements for Cybersecurity, pp. 217-222: IEEE.
dc.identifier.urihttp://hdl.handle.net/20.500.11937/65570
dc.identifier.doi10.1109/SPW.2017.20
dc.description.abstract

It has been previously determined that SYN packet inter arrival times are conformant with Benford’s law, which predicts the frequency of the leading digits in naturally occurring collections of numbers, and suggested that conformity or non-conformity to Benford’s law could be used to detect network anomalies. This paper expands upon that suggestion by making three contributions. First, we verify that conformity to Benford’s law of inter arrival times is also true for certain types of both TCP and UDP packets. Second, we discover that packet length could also be another alternative to inter arrival times, with the advantage that it follows both Benford’s and Zipf’s laws, implying its reliability in detecting network traffic anomaly. Finally, we explore the potential application of power laws in the specific detection of denial-of-service (DoS) attacks using both inter arrival times and packet length. Extensive experiments on the MAWI benchmark dataset and two additional datasets support our claims and demonstrate that whilst Benfordian analysis of inter arrival times can identify DoS attacks, the combination of Benfordian and Zipfian analysis of packet length gives more reliable detection.

dc.publisherIEEE
dc.relation.urihttp://ieeexplore.ieee.org/
dc.titleAn Investigation of Power Law Probability Distributions for Network Anomaly Detection
dc.typeConference Paper
dcterms.source.startPage217
dcterms.source.endPage222
dcterms.source.titlehttp://ieeexplore.ieee.org/document/8227310/
dcterms.source.serieshttp://ieeexplore.ieee.org/document/8227310/
dcterms.source.isbn9781538619674
dcterms.source.conferenceIEEE Security and Privacy Workshop on Traffic Measurements for Cybersecurity
dcterms.source.placeUSA
curtin.departmentSchool of Electrical Engineering, Computing and Mathematical Science (EECMS)
curtin.accessStatusFulltext not available


Files in this item

FilesSizeFormatView

There are no files associated with this item.

This item appears in the following Collection(s)

Show simple item record