A new statistical approach to network anomaly detection

Christian Callegari (1) , Sandrine Vaton (2) , Michele Pagano (1)

1 TLCNETGRP - TLC Network Research Group
2 INFO - Département informatique

In the last few years, the number and impact of security attacks over the Internet have been continuously increasing. To face this issue, the use of Intrusion Detection Systems (IDSs) has emerged as a key element in network security. In this paper we address the problem considering a novel statistical technique for detecting network anomalies. Our approach is based on the use of different families of Markovian models (namely high order and non homogeneous Markov chains) for modeling network traffic running over TCP. The performance results shown in the paper, justify the proposed method and highlight the improvements over commonly used statistical techniques.

Mots clés: Intrusion detection system; High order Markov chain; Mixture transition model; Non-homogeneous Markov chain

Domaines: Cryptographie et sécurité [cs.CR]; Applications [stat.AP]

Christian Callegari, Sandrine Vaton, Michele Pagano. A new statistical approach to network anomaly detection. SPECTS'08 : International Symposium on Performance Evaluation of Computer and Telecommunication Systems, Jun 2008, Edinburgh, United Kingdom. pp.441-447. ⟨hal-00540882⟩