Uncovering anomaly traffic based on loss of self-similarity behavior using second order statistical model

Abstract

Malicious traffic such as Denial of Service (DoS) attack has potential to introduce distribution error and perturbs the self-similarity property of network traffic. As a result, loss of self-similarity (LoSS) is detected which indicates poor Quality of Service (QoS) performance. In order to fulfill the demand for high speed and detection accuracy, this paper proposes LoSS detection method with second order self-similarity statistical (SOSS) model and estimates the self-similarity parameter using the optimization method (OM). We investigate the behavior of self-similarity property for normal and abnormal traffic traces with different sampling levels. We test our approach using synthetic and real traffic simulation datasets. The results demonstrate that the proposed method has successfully exposed the abnormality of Internet traffic behavior. However, the experimental results show that fixed sampling level is not sufficient to reveal the self-similarity distribution error accurately. Accordingly, we introduce a new set of multi-level sampling parameters and propose a new LoSS detection method with multi-level sampling approach in order to improve the detection accuracy.