%0 Conference Proceedings
%T A Network Forensic Scheme Using Correntropy-Variation for Attack Detection
%+ University of New South Wales [Canberra Campus] (UNSW)
%+ Australian Cyber Security Centre (ACSC)
%+ La Trobe University [Melbourne]
%A Moustafa, Nour
%A Slay, Jill
%Z Part 3: Network Forensics
%< avec comité de lecture
%( IFIP Advances in Information and Communication Technology
%B 14th IFIP International Conference on Digital Forensics (DigitalForensics)
%C New Delhi, India
%Y Gilbert Peterson
%Y Sujeet Shenoi
%I Springer International Publishing
%3 Advances in Digital Forensics XIV
%V AICT-532
%P 225-239
%8 2018-01-03
%D 2018
%R 10.1007/978-3-319-99277-8_13
%K Network forensics
%K cyber attacks
%K correntropy-variation technique
%Z Computer Science [cs]Conference papers
%X Network forensic techniques help track cyber attacks by monitoring and analyzing network traffic. However, due to the large volumes of data in modern networks and sophisticated attacks that mimic normal behavior and/or erase traces to avoid detection, network attack investigations demand intelligent and efficient network forensic techniques. This chapter proposes a network forensic scheme for monitoring and investigating network-based attacks. The scheme captures and stores network traffic data, selects important network traffic features using the chi-square statistic and detects anomalous events using a novel correntropy-variation technique. An evaluation of the network forensic scheme employing the UNSW-NB15 dataset demonstrates its utility and high performance compared with three state-of-the-art approaches.
%G English
%Z TC 11
%Z WG 11.9
%2 https://inria.hal.science/hal-01988843/document
%2 https://inria.hal.science/hal-01988843/file/472401_1_En_13_Chapter.pdf
%L hal-01988843
%U https://inria.hal.science/hal-01988843
%~ IFIP-LNCS
%~ IFIP
%~ IFIP-AICT
%~ IFIP-TC
%~ IFIP-WG
%~ IFIP-TC11
%~ IFIP-DF
%~ IFIP-WG11-9
%~ IFIP-AICT-532