A Novel Abnormal Traffic Detection Method Based on Statistical Model

Abstract:

An abnormal traffic detection method via statistical model is proposed in this paper. At first, a new feature of normal traffic that it represents significant one-order dependency is discovered. In other words, normal traffic is obviously positive correlative. But the feature rarely appears in abnormal traffic. Based on one-order dependency, an entropy-rate model which is highly relevant to Markov model is then introduced by this paper to detect abnormal traffic. The proposed method is independent of signature so that it is able to detection both known and unknown abnormal traffic. At last, contrast experiment shows that the proposed method outperforms current methods in terms of false positives and false negatives.

• Periodical: Advanced Materials Research (Volumes 846-847)
• Pages: 1072-1075
• DOI: https://doi.org/10.4028/www.scientific.net/AMR.846-847.1072
• Online since: November 2013
• Authors: Ting Chen*, Yue Wu
• Keywords: Entropy Rate, Markov Model, One Order Dependency, Statistical Model, Traffic Detection

References

[1] NEWSOME J, KARP B, SONG D. Polygraph: Automatically generating signatures for polymorphic worms [C]. In IEEE Security and Privacy Symposium, (2005).

DOI: 10.1109/sp.2005.15

[2] ZHANG Xiaosong, CHEN Ting, CHEN Dapeng, LIU Zhi. SISG: self-immune automated signature generation for polymorphic worms [J]. The International Journal for Computation and Mathematics in Electroinc Engineering, 2010 29(2): 445-567.

DOI: 10.1108/03321641011014913

[3] JUNG J, PAXSON V, BERGER A W, BALAKRISHNAN H. Fastportscan detection using sequential hypothesis testing [C]. In Proceedings of the IEEE Symposium on Security and Privacy, (2004).

DOI: 10.1109/secpri.2004.1301325

[4] PAN Xiaohui, ZHANG Xiaosong CHEN Ting. A Novel Hybrid Method for Polymorphic Worm Detection [C]. On Proceedings of 2009 International Conference on E-Business and Information System Security, Vol 1, pp.50-55.

DOI: 10.1109/ebiss.2009.5137885

[5] LI Jun, ZHANG Shunyi, LIU Shidong, XUAN Ye. Active P2P traffic identification technique [C]. In Proceedings of 2007 International Conference on Computational Intelligence and Security, 2007, pp.37-41.

DOI: 10.1109/cis.2007.81

[6] NEWSOME J, KARP B, SONG D. Paragraph: thwarting signature learning by training maliciously [C]. Proceedings of 9th International Symposium on Recent Advances in Intrusion Detection (RAID'06), 2006, 81-105.

DOI: 10.1007/11856214_5

[7] CHEN Ting, ZHANG Xiaosong, LIU Zhi. A hybrid detection approach for zero-day polymorphic shellcodes [C]. Proceedings International Conference on E-Business and Information System Security, 2009, Vol. 1: 45-50.

DOI: 10.1109/ebiss.2009.5137874

[8] TOTH T, KRUEGEL C. Accurate Buffer Overflow Detection via Abstract Payload Execution [C]. In Proceedings of the 5th International Symposium on Recent Advances in Intrusion Detection (RAID'02), p.274–291, (2002).

DOI: 10.1007/3-540-36084-0_15

[9] AKRITIDIS P, Evangelos P. MARKATOS E P, POLYCHRONAKIS M, ANAGNOSTAKIS K. STRIDE: Polymorphic Sled Detection through Instruction Sequence Analysis [C]. 20th IFIP International Information Security Conference, (2005).

DOI: 10.1007/0-387-25660-1_25

[10] POLYCHRONAKIS M, ANAGNOSTAKIS K, MARKATOS E P. Network-level polymorphic shellcode detection using emulation [C]. Detection of Intrusions and Malware and Vulnerability Assessment-Third International Conference, Proceedings, (2006).

DOI: 10.1007/11790754_4