Online and Scalable Unsupervised Network Anomaly Detection Method
Résumé
Nowadays, network intrusion detectors mainly rely
on knowledge databases to detect suspicious traffic. These
databases have to be continuously updated which requires impor-
tant human resources and time. Unsupervised network anomaly
detectors overcome this issue by using “intelligent” techniques
to identify anomalies without any prior knowledge. However,
these systems are often very complex as they need to explore
the network traffic to identify flows patterns. Therefore, they
are often unable to meet real-time requirements. In this paper,
we present a new Online and Real-time Unsupervised Network
Anomaly Detection Algorithm: ORUNADA. Our solution relies
on a discrete time-sliding window to update continuously the fea-
ture space and an incremental grid clustering to detect rapidly the
anomalies. The evaluations showed that ORUNADA can process
online large network traffic while ensuring a low detection delay
and good detection performance. The experiments performed on
the traffic of a core network of a Spanish intermediate Internet
service provider demonstrated that ORUNADA detects in less
than half a second an anomaly after its occurrence. Furthermore,
the results highlight that our solution outperforms in terms
Origine | Fichiers produits par l'(les) auteur(s) |
---|
Loading...