NetFlow 데이터를 이용한 실시간 네트워크 트래픽 어노멀리 검출 기법
A Real-Time Network Traffic Anomaly Detection Scheme Using NetFlow Data
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
최근 알려지지 않은 공격(unknown attack)으로부터 네트워크를 보호하기 위한 네트워크 트래픽 어노멀리(anomaly) 검출에 대한 관심이 고조되고 있다. 본 논문에서는 캠퍼스 네트워크의 보드라우터(border router)의 NetFlow 데이터로 제공되는 초당비트수(bits per second)와 초당플로수(flows per second)의 상관관계를 단순회귀분석을 통하여 새로운 어노멀리 검출 기법을 제시하였다. 새로이 제안된 기법을 검증하기 위해 실지 캠퍼스 네트워크에 적용하였으며 그 결과를 Holt-Winters seasonal(HWS) 알고리즘과 비교하였다. 특히, 제안된 기법은 기존 RRDtool에 통합시켜 실시간 검출이 가능하도록 설계하였다.
Abstract
Recently, it has been sharply increased the interests to detect the network traffic anomalies to help protect the computer network from unknown attacks. In this paper, we propose a new anomaly detection scheme using the simple linear regression analysis for the exported NetFlow data, such as bits per second and flows per second, from a border router at a campus network. In order to verify the proposed scheme, we apply it to a real campus network and compare the results with the Holt-Winters seasonal algorithm. In particular, we integrate it into the RRDtool for detecting the anomalies in real time.
참고문헌 (17)
- "Snort Lightweight Intrusion Detection for Networks" (1999)
- "Towards a taxonomy of intrusion-detection systems", 31(8), pp.805~822 (1990)
- "Next Generation Intrusion Detection System (IDS)" (2002)
- "Learning Nonstationay Models of Normal Network Traffic for Detecting Novel Attacks" (2002)
- "A Sense of Self for Unix Processes" (1996)
- "Anomaly Detection over Noisy Data using Learned Probability Distributions", 2000 (2000)
- "Characteristics of Network Traffic Flow Anomalies" (2001)
- "A Signal Analysis of Network Traffic Anomalies" (2002)
- "Aberrant Behavior Detection in Time Series for Network Monitoring" (2000)
- "Introductionto Time Series and Forecasting" (1996), Springer-Verlag
- "Introduction to Linear Regression Analysis" (1992), Inc.
- "Flowscan：A network traffic flow reporting and visualization tool" (2000)
- "NetFlow Services Solutions Guide" (2001)
- "The RRDtool manuals"
- "The Cricket reference guide"
- "SPSS manual"
- "Management information base for network management of tcp", ip based internets：Mib 2, 1991., ~