Anomaly Detection Framework Based on Matching Pursuit for Network Security Enhancement
DOI:
https://doi.org/10.26636/jtit.2011.1.1131Keywords:
anomaly detection, intrusion detection, matching pursuit, network security, signal processingAbstract
In this paper, a framework for recognizing network traffic in order to detect anomalies is proposed. We propose to combine and correlate parameters from different layers in order to detect 0-day attacks and reduce false positives. Moreover, we propose to combine statistical and signal-based features. The major contribution of this paper are: novel framework for network security based on the correlation approach as well as new signal based algorithm for intrusion detection using matching pursuit.
Downloads
References
[1] M. Esposito, C. Mazzariello, F. Oliviero, S. Romano, and C. Sansone, „Real time detection of novel attacks by means of data mining techniques”, Enterprise Information Systems, VII 2006, Part 3, pp. 197-204.
View in Google Scholar
[2] M. Esposito, C. Mazzariello, F. Oliviero, S. Romano, and C. Sansone, „Evaluating pattern recognition techniques in intrusion detection systems”, in Proc. 5th Int. Worksh. Pattern Recogn. Inf. Sys. PRIS 2005, Miami, USA, 2005, pp. 144-153.
View in Google Scholar
[3] C.-M. Cheng, H. T. Kung, and K.-S. Tan, „Use of spectral analysis in defense against DoS attacks”, in Proc. IEEE Glob. Telecommun. Conf. GLOBECOM’02, Taipei, Taiwan, 2002, vol. 3, pp. 2143-2148.
View in Google Scholar
[4] P. Barford, J. Kline, D. Plonka, and A. Ron, „A signal analysis of network traffic anomalies”, in Proc. Internet Measur. Worksh. ACM SIGCOMM 2002, Pittsburgh, USA, 2002.
View in Google Scholar
[5] P. Huang, A. Feldmann, and W. Willinger, „A non-intrusive, wavelet-based approach to detecting network performance problems”, in Proc. Internet Measur. Worksh. ACM SIGCOMM 2001, San Diego, USA, 2001.
View in Google Scholar
[6] L. Li and G. Lee, „DDoS attack detection and wavelets”, in Proc. 12th Int. Conf. Comp. Commun. Netw. ICCCN’03, Dallas, USA, 2003, pp. 421-427.
View in Google Scholar
[7] A. Dainotti, A. Pescape, and G. Ventre, „NIS04-1: wavelet-based detection of DoS attacks”, in Proc. IEEE Glob. Telecommun. Conf. GLOBECOM’06, San Francisco, USA, 2006, pp. 1-6.
View in Google Scholar
[8] S. G. Mallat and Z. Zhang, „Matching pursuits with time-frequency dictionaries”, IEEE Trans. Sig. Process., vol. 41, no. 12, pp. 3397-3415, 1993.
View in Google Scholar
[9] P. Jost, P. Vandergheynst, and P. Frossard, „Tree-based pursuit: algorithm and properties”, IEEE Trans. Sig. Process., vol. 54, no. 12, pp. 4685-4697, 2006.
View in Google Scholar
[10] J. A. Tropp, „Greed is good: algorithmic results for sparse approximation”, IEEE Trans. Inf. Theory, vol. 50, no. 10, pp. 2231-2242, 2004.
View in Google Scholar
[11] R. Gribonval, „Fast matching pursuit with a multiscale dictionary of Gaussian chirps”, IEEE Trans. Sig. Process., vol. 49, no. 5, pp. 994-1001, 2001.
View in Google Scholar
[12] „WIDE Project: MAWI Working Group Traffic Archive” [Online]. Available: http://tracer.csl.sony.co.jp/mawi/
View in Google Scholar
[13] „Network Tools and Traffic Traces”, Universita’ degli Studi di Napoli „Federico II” [Online]. Available: http://www.grid.unina.it/Traffic/Traces/ttraces.php
View in Google Scholar
[14] C. Shannon and D. Moore, „The CAIDA Dataset on the Witty Worm”, March 19-24, 2004 [Online]. Available: http://www.caida.org/passive/witty
View in Google Scholar
Downloads
Submitted
Published
Issue
Section
License
Copyright (c) 2023 Journal of Telecommunications and Information Technology
This work is licensed under a Creative Commons Attribution 4.0 International License.
