Modelling network traffic to detect new anomalies using principals components analysis

Modélisation du trafic réseau pour détecter de nouvelles anomalies à l'aide de l'analyse des composants principaux

Yacine Bouzida (1) , Frédéric Cuppens (1) , Sylvain Gombault (1)

1 RSM - Département Réseaux, Sécurité et Multimédia

We introduce a novel real time anomaly intrusion detection method using a multivariate statistical technique based on principal component analysis (PCA) to detect new anomalies. In fact, new attack forms are increasing each day and most of the current intrusion detection systems are signature based ones. As a result, these signature based tools fail to detect the new attacks. For this reason, network traffic modeling should be done in order to apply anomaly detection methods directly on the new modeled traffic. Different characteristics of the network traffic are analyzed, packet by packet, using PCA and significant statistical measures are considered to discover the difference between the normal (legitimate) and abnormal (called also illegitimate or attacks) traffic. An algorithm issued from the different statistical measures is discussed and the different results, performed over real time traffic corresponding to the different flooding DDoS attacks and the slammer worm that has infected more than 100,000 vulnerable servers in less than ten minutes, are presented.

Mots clés: Principal Component Analysis; Statistical Measures; Anomaly Intrusion Detection; Novel Attacks

Domaines: Cryptographie et sécurité [cs.CR]; Multimédia [cs.MM]; Réseaux et télécommunications [cs.NI]

Yacine Bouzida, Frédéric Cuppens, Sylvain Gombault. Modelling network traffic to detect new anomalies using principals components analysis. HPOVUA 2005 : 12th Workshop of the HP OpenView University Association, Jul 2005, Porto, Portugal. pp.119 - 132. ⟨hal-01833583⟩