Online and Scalable Unsupervised Network Anomaly Detection Method - LAAS-Réseaux et Communications Accéder directement au contenu
Article Dans Une Revue IEEE Transactions on Network and Service Management Année : 2017

Online and Scalable Unsupervised Network Anomaly Detection Method

Résumé

Nowadays, network intrusion detectors mainly rely on knowledge databases to detect suspicious traffic. These databases have to be continuously updated which requires impor- tant human resources and time. Unsupervised network anomaly detectors overcome this issue by using “intelligent” techniques to identify anomalies without any prior knowledge. However, these systems are often very complex as they need to explore the network traffic to identify flows patterns. Therefore, they are often unable to meet real-time requirements. In this paper, we present a new Online and Real-time Unsupervised Network Anomaly Detection Algorithm: ORUNADA. Our solution relies on a discrete time-sliding window to update continuously the fea- ture space and an incremental grid clustering to detect rapidly the anomalies. The evaluations showed that ORUNADA can process online large network traffic while ensuring a low detection delay and good detection performance. The experiments performed on the traffic of a core network of a Spanish intermediate Internet service provider demonstrated that ORUNADA detects in less than half a second an anomaly after its occurrence. Furthermore, the results highlight that our solution outperforms in terms
Fichier principal
Vignette du fichier
ORUNADA_Final_version.pdf (2.46 Mo) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

hal-01406273 , version 1 (03-07-2017)

Identifiants

Citer

Juliette Dromard, Gilles Roudiere, Philippe Owezarski. Online and Scalable Unsupervised Network Anomaly Detection Method. IEEE Transactions on Network and Service Management, 2017, 14 (1), pp.34-47. ⟨10.1109/TNSM.2016.2627340⟩. ⟨hal-01406273⟩
173 Consultations
159 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More