DIAMoND: Distributed Intrusion/Anomaly Monitoring for Nonparametric Detection

In this paper, we describe a fully nonparametric, scalable, distributed detection algorithm for intrusion/anomaly detection in networks. We discuss how this approach addresses a growing trend in distributed attacks while also providing solutions to problems commonly associated with distributed detec...

Full description

Saved in:
Bibliographic Details
Main Authors: Korczynski, Maciej, Hamieh, Ali, Jun Ho Huh, Holm, Henrik, Rajagopalan, S. Raj, Fefferman, Nina H.
Format: Conference Proceeding
Language:English
Subjects:
Accuracy
Detection algorithms
Diamonds
Network topology
Protocols
Sensitivity
Topology
Online Access:Request full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:In this paper, we describe a fully nonparametric, scalable, distributed detection algorithm for intrusion/anomaly detection in networks. We discuss how this approach addresses a growing trend in distributed attacks while also providing solutions to problems commonly associated with distributed detection systems. We explore the impacts to detection performance from network topology, from the defined range of distributed communication for each node, and from involving only a small percent of total nodes in the network in the distributed detection communication. We evaluate our algorithm using a software-based testing implementation, and demonstrate up to 20% improvement in detection capability over parallel, isolated anomaly detectors for both stealthy port scans and DDoS attacks.
ISSN:1095-2055
2637-9430
DOI:10.1109/ICCCN.2015.7288396