A Comparison Between Divergence Measures for Network Anomaly Detection

Jean Tajer (1) , Ali Makke (1) , Osman Salem (1) , Ahmed Mehaoua (1)

1 LIPADE - EA 2517 - Laboratoire d'Informatique Paris Descartes

This paper deals with the detection of flooding attacks which are the most common type of Denial of Service (DoS) attacks. We compare 2 divergence measures (Hellinger distance and Chi-square divergence) to analyze their detection accuracy. The performance of these statistical divergence measures are investigated in terms of true positive and false alarm ratio. A particular focus will be on how to use these measures over Sketch data structure, and which measure provides the best detection accuracy. We conduct performance analysis over publicly available real IP traces (MAWI) collected from the WIDE backbone network. Our experimental results show that Chi-square divergence outperforms Hellinger distance in network anomalies detection.

Domaines: Réseaux et télécommunications [cs.NI]

Jean Tajer, Ali Makke, Osman Salem, Ahmed Mehaoua. A Comparison Between Divergence Measures for Network Anomaly Detection. 7th International Conference on Network and Service Management (CNSM 11), 2011, pp.1 - 5. ⟨hal-00844968⟩