Human error tolerant anomaly detection using time-periodic packet sampling

研究成果: Conference contribution

1 被引用数 (Scopus)

抄録

This paper focuses on an anomaly detection method that uses a baseline model describing the normal behavior of network traffic as the basis for comparison with the audit network traffic. In the anomaly detection method, an alarm is raised if a pattern in the current network traffic deviates from the baseline model. The baseline model is often trained using normal traffic data extracted from traffic data for which all instances (i.e., packets) are manually labeled by human experts in advance as either normal or anomalous. However, since humans are fallible, some errors are inevitable in labeling traffic data. Therefore, in this paper, we propose an anomaly detection method that is tolerant to human errors in labeling traffic data. The fundamental idea behind the proposed method is to take advantage of the lossy nature of packet sampling for the purpose of correcting/preventing human errors in labeling traffic data. By using real traffic traces, we show that the proposed method can better detect anomalies regarding TCP SYN packets than the method that relies only on human labeling.

本文言語English
ホスト出版物のタイトルProceedings - 2014 International Conference on Intelligent Networking and Collaborative Systems, IEEE INCoS 2014
出版社Institute of Electrical and Electronics Engineers Inc.
ページ390-395
ページ数6
ISBN(電子版)9781479963867
DOI
出版ステータスPublished - 2014 3 9
外部発表はい
イベント6th International Conference on Intelligent Networking and Collaborative Systems, IEEE INCoS 2014 - Salerno, Italy
継続期間: 2014 9 102014 9 12

Other

Other6th International Conference on Intelligent Networking and Collaborative Systems, IEEE INCoS 2014
CountryItaly
CitySalerno
Period14/9/1014/9/12

ASJC Scopus subject areas

  • Artificial Intelligence
  • Computer Networks and Communications

フィンガープリント 「Human error tolerant anomaly detection using time-periodic packet sampling」の研究トピックを掘り下げます。これらがまとまってユニークなフィンガープリントを構成します。

引用スタイル