%0 Conference Proceedings
%T On Detecting Abrupt Changes in Network Entropy Time Series
%+ University of Applied Sciences Upper Austria (FH OÖ)
%A Winter, Philipp
%A Lampesberger, Harald
%A Zeilinger, Markus
%A Hermann, Eckehard
%Z Part 2: Work in Progress
%< avec comité de lecture
%( Lecture Notes in Computer Science
%B 12th Communications and Multimedia Security (CMS)
%C Ghent, Belgium
%Y Bart Decker
%Y Jorn Lapon
%Y Vincent Naessens
%Y Andreas Uhl
%I Springer
%3 Communications and Multimedia Security
%V LNCS-7025
%P 194-205
%8 2011-10-19
%D 2011
%R 10.1007/978-3-642-24712-5_18
%K entropy
%K anomaly detection
%K time series analysis
%K network flows
%Z Computer Science [cs]
%Z Computer Science [cs]/Networking and Internet Architecture [cs.NI]Conference papers
%X In recent years, much research focused on entropy as a metric describing the “chaos” inherent to network traffic. In particular, network entropy time series turned out to be a scalable technique to detect unexpected behavior in network traffic.In this paper, we propose an algorithm capable of detecting abrupt changes in network entropy time series. Abrupt changes indicate that the underlying frequency distribution of network traffic has changed significantly. Empirical evidence suggests that abrupt changes are often caused by malicious activity such as (D)DoS, network scans and worm activity, just to name a few.Our experiments indicate that the proposed algorithm is able to reliably identify significant changes in network entropy time series. We believe that our approach helps operators of large-scale computer networks in identifying anomalies which are not visible in flow statistics.
%G English
%Z TC 6
%Z TC 11
%2 https://inria.hal.science/hal-01596209/document
%2 https://inria.hal.science/hal-01596209/file/978-3-642-24712-5_18_Chapter.pdf
%L hal-01596209
%U https://inria.hal.science/hal-01596209
%~ IFIP-LNCS
%~ IFIP
%~ IFIP-TC
%~ IFIP-TC11
%~ IFIP-TC6
%~ IFIP-CMS
%~ IFIP-LNCS-7025