Detecting an Anomalous Traffic Attack Area based on Entropy Distribution and Mahalanobis Distance

This paper deals with detecting an anomalous traffic area based on its distribution and distance measurements. On detecting anomalous traffic such as flooding attack traffic we should consider the packet attribute of the traffic. In order to identify that traffic, we compute entropy of selected pack...

Full description

Saved in:
Bibliographic Details
Published inInternational Journal of Security and Its Applications Vol. 8; no. 2; pp. 87 - 94
Main Authors Bayarjargal, Dolgormaa, Cho, Gihwan
Format Journal Article
LanguageEnglish
Published 31.03.2014
Subjects
Entropy
Anomalous traffic
Flooding attack
Mahalanobis distance
Online AccessGet full text

Cover

More Information
Summary:This paper deals with detecting an anomalous traffic area based on its distribution and distance measurements. On detecting anomalous traffic such as flooding attack traffic we should consider the packet attribute of the traffic. In order to identify that traffic, we compute entropy of selected packet attribute and Mahalanobis distance between normal and abnormal traffics. Chi-square test is used to evaluate the proposed method. Detection accuracy and performance are analyzed using real network traffic trace which consists the mostly backscatter of SYN flooding attack from LANDER project. The result of our proposed method indicates that it can show and offer significantly an accurate result.
ISSN:1738-9976
1738-9976
DOI:10.14257/ijsia.2014.8.2.09