Show simple item record

dc.contributor.authorPrandl, S.
dc.contributor.authorLazarescu, M.
dc.contributor.authorPham, DucSon
dc.contributor.authorSoh, Sie Teng
dc.contributor.authorKak, S.
dc.identifier.citationPrandl, S. and Lazarescu, M. and Pham, D. and Soh, S.T. and Kak, S. 2017. An Investigation of Power Law Probability Distributions for Network Anomaly Detection, IEEE Security and Privacy Workshop on Traffic Measurements for Cybersecurity, pp. 217-222: IEEE.

It has been previously determined that SYN packet inter arrival times are conformant with Benford’s law, which predicts the frequency of the leading digits in naturally occurring collections of numbers, and suggested that conformity or non-conformity to Benford’s law could be used to detect network anomalies. This paper expands upon that suggestion by making three contributions. First, we verify that conformity to Benford’s law of inter arrival times is also true for certain types of both TCP and UDP packets. Second, we discover that packet length could also be another alternative to inter arrival times, with the advantage that it follows both Benford’s and Zipf’s laws, implying its reliability in detecting network traffic anomaly. Finally, we explore the potential application of power laws in the specific detection of denial-of-service (DoS) attacks using both inter arrival times and packet length. Extensive experiments on the MAWI benchmark dataset and two additional datasets support our claims and demonstrate that whilst Benfordian analysis of inter arrival times can identify DoS attacks, the combination of Benfordian and Zipfian analysis of packet length gives more reliable detection.

dc.titleAn Investigation of Power Law Probability Distributions for Network Anomaly Detection
dc.typeConference Paper
dcterms.source.conferenceIEEE Security and Privacy Workshop on Traffic Measurements for Cybersecurity
curtin.departmentSchool of Electrical Engineering, Computing and Mathematical Science (EECMS)
curtin.accessStatusFulltext not available

Files in this item


There are no files associated with this item.

This item appears in the following Collection(s)

Show simple item record