Universiti Teknologi Malaysia Institutional Repository

Iterative window size estimation on self-similarity measurement for network traffic anomaly detection

Idris, Mohd Yazid and Abdullah, Abdul Hanan and Maarof, Mohd Aizaini (2004) Iterative window size estimation on self-similarity measurement for network traffic anomaly detection. Journal of computing and information science, 2 (2). pp. 84-91. ISSN 1708-0460

[img] PDF - Published Version
12Kb

Official URL: http://www.ijcis.info/Vol2N2/84-91OKS.pdf

Abstract

An iterative method for estimating the optimum sample time (or simply window size) in self-similarity measurement of network traffic is introduced. The main purpose of this measurement is to identify anomaly in network traffic. When the network traffic is close to the self-similarity model, it is considered as normal while otherwise it is not. Since, this model is related to a long-range dependence process, providing data in long period of time will increase the closeness of the network traffic towards the model. On the other hand, increasing the time range is one of the factors that will increase detection loss probability where an intrusive pattern may hide inside the normal data. Thus, the purpose of this method is to minimize the curve-fitting error on self-similarity measurement and detection loss probability in anomaly detection. This iterative method was applied to network traffic data provided by Lincoln Lab, Massachuset Institute of Technology (MIT). The result has shown, that this method is able to estimate an optimum window size that is capable to reduce detection loss probability and maintain a low error rate.

Item Type:Article
Uncontrolled Keywords:network traffic, self-similarity measurement, iterative method, anomaly detection
Subjects:Q Science > QA Mathematics > QA75 Electronic computers. Computer science
Divisions:Computer Science and Information System (Formerly known)
ID Code:5031
Deposited By: Mohd Yazid Idris
Deposited On:22 Jan 2008 09:12
Last Modified:03 Sep 2012 06:26

Repository Staff Only: item control page