A novel approach for anomaly detection over high-speed networks

Osman Salem (1) , Sandrine Vaton (1) , Annie Gravey (1)

1 INFO - Département informatique

This paper provides a new framework for efficient detection and identification of network anomalies over high speed links, in early stage of its occurrence to quickly react by taking the appropriate counter-measures. The proposed framework is based on change point detection in counters value of reversible sketch, which aggregates multiple data streams from high speed links in a stretched database. To detect network anomalies, we apply the cumulative sum (CUSUM) algorithm at the counter value of each bucket in the proposed reversible sketch, to detect change point occurrence and to uncover culprit flows via a new approach for sketch inversion. Theoretical framework for attacks detection is presented. We also give the results of our experiments analysis over two real data traces containing anomalies, and extensively analyzed in OSCAR French research project. Our analysis results from real-time internet traffic and online implementation over Endace DAG 3.6ET card show that our proposed architecture is able to detect culprit flows quickly with a high level of accuracy.

Mots clés: Sketch; Network anomaly detection; Change point detection; Multichart cumulative sum; DoS

Osman Salem, Sandrine Vaton, Annie Gravey. A novel approach for anomaly detection over high-speed networks. EC2ND : European Conference on Computer Network Defense, Oct 2007, Heraklion, Greece. ⟨hal-00504310⟩