A comparison between divergence measures for network anomaly detection

This paper deals with the detection of flooding attacks which are the most common type of Denial of Service (DoS) attacks. We compare 2 divergence measures (Hellinger distance and Chi-square divergence) to analyze their detection accuracy. The performance of these statistical divergence measures are...

Full description

Saved in:
Bibliographic Details
Main Authors: Tajer, J., Makke, A., Salem, O., Mehaoua, A.
Format: Conference Proceeding
Language:English
Subjects:
Accuracy
Chi-Square Divergence
Data structures
DDoS
Hellinger Distance
High definition video
IP networks
K-ary Sketch
Probability distribution
Radiation detectors
TCP SYN Flooding
Time series analysis
Online Access:Request full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:This paper deals with the detection of flooding attacks which are the most common type of Denial of Service (DoS) attacks. We compare 2 divergence measures (Hellinger distance and Chi-square divergence) to analyze their detection accuracy. The performance of these statistical divergence measures are investigated in terms of true positive and false alarm ratio. A particular focus will be on how to use these measures over Sketch data structure, and which measure provides the best detection accuracy. We conduct performance analysis over publicly available real IP traces (MAWI) collected from the WIDE backbone network. Our experimental results show that Chi-square divergence outperforms Hellinger distance in network anomalies detection.
ISSN:2165-9605