On detecting abrupt changes in network entropy time series

Research output: Chapter in Book/Report/Conference proceedingsConference contributionpeer-review

14 Citations (Scopus)

Abstract

In recent years, much research focused on entropy as a metric describing the "chaos" inherent to network traffic. In particular, network entropy time series turned out to be a scalable technique to detect unexpected behavior in network traffic. In this paper, we propose an algorithm capable of detecting abrupt changes in network entropy time series. Abrupt changes indicate that the underlying frequency distribution of network traffic has changed significantly. Empirical evidence suggests that abrupt changes are often caused by malicious activity such as (D)DoS, network scans and worm activity, just to name a few. Our experiments indicate that the proposed algorithm is able to reliably identify significant changes in network entropy time series. We believe that our approach helps operators of large-scale computer networks in identifying anomalies which are not visible in flow statistics.

Original languageEnglish
Title of host publicationCommunications and Multimedia Security - 12th IFIP TC 6 / TC 11 International Conference, CMS 2011, Proceedings
Pages194-205
Number of pages12
Volume7025
Edition7025
DOIs
Publication statusPublished - 2011
Event12th IFIP TC-6 and TC-11 Conference on Communications and Multimedia Security, CMS 2011 - Ghent, Belgium
Duration: 19 Oct 201121 Oct 2011

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume7025 LNCS
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349

Conference

Conference12th IFIP TC-6 and TC-11 Conference on Communications and Multimedia Security, CMS 2011
CountryBelgium
CityGhent
Period19.10.201121.10.2011

Keywords

  • anomaly detection
  • entropy
  • network flows
  • time series analysis

Fingerprint Dive into the research topics of 'On detecting abrupt changes in network entropy time series'. Together they form a unique fingerprint.

Cite this