Entropy and Flow-based Approach for Anomalous Traffic Filtering

Research Tools in Anomaly-based Intrusion Detection are highly dependent on appropriate traffic trace data. Traditional datasets present several issues such as: removal of sensitive information (anonymization) and insufficient number or volume of attack instances, which limit their quality for the d...

Full description

Saved in:
Bibliographic Details
Published in:Procedia technology 2013, Vol.7, p.360-369
Main Authors: Zempoaltecatl-Piedras, Rafael, Velarde-Alvarado, Pablo, Torres-Roman, Deni
Format: Article
Language:English
Subjects:
A-NIDS
Entropy
Flow-level traffic filtering
Network security
Citations: Items that this one cites
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:Research Tools in Anomaly-based Intrusion Detection are highly dependent on appropriate traffic trace data. Traditional datasets present several issues such as: removal of sensitive information (anonymization) and insufficient number or volume of attack instances, which limit their quality for the design and evaluation of A-NIDSs. In this paper, we present a method for anomalous traffic filtering which can be used for generating anomaly-free traffic traces. The sanitized dataset can be used to improve the computation of the behaviour profiles during the training stage. The proposal is based on the construction and statistical analysis of the flow-level entropy space for the identification of outliers using three entropy estimators. Empirical results showed that the new traffic traces of the sanitized dataset have a distributional similarity among them greater than that presented among the original datasets.
ISSN:2212-0173
2212-0173
DOI:10.1016/j.protcy.2013.04.045