Real-Time Dynamic Network Anomaly Detection

Cybersecurity increasingly relies on the methodology used for statistical analysis of network data. The volume and velocity of enterprise network data sources puts a premium on streaming analytics that pass over the data once, while handling temporal variation in the process. In this paper we introd...

Full description

Saved in:
Bibliographic Details
Published in:IEEE intelligent systems 2018-03, Vol.33 (2), p.5-18
Main Authors: Noble, Jordan, Adams, Niall
Format: Article
Language:English
Subjects:
Adaptation models
Adaptive estimation
Anomalies
Anomaly detection
Computer security
Cybercrime
Cybersecurity
Graph theory
Image edge detection
Network security
real time analytics
ReTiNA
Situational awareness
Statistical analysis
streaming data
Citations: Items that this one cites
Items that cite this one
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:Cybersecurity increasingly relies on the methodology used for statistical analysis of network data. The volume and velocity of enterprise network data sources puts a premium on streaming analytics that pass over the data once, while handling temporal variation in the process. In this paper we introduce ReTiNA: a framework for streaming network anomaly detection. This procedure first detects anomalies in the correlation processes on individual edges of the network graph. Second, anomalies across multiple edges are combined and scored to give network-wide situational awareness. The approach is tested in simulation and demonstrated on two real Netflow datasets.
ISSN:1541-1672
1941-1294
DOI:10.1109/MIS.2018.022441346