A novel approach to detection of intrusions in computer networks via adaptive sequential and batch-sequential change-point detection methods

• Published in: IEEE transactions on signal processing Vol. 54; no. 9; pp. 3372 - 3382
• Main Authors: Tartakovsky, A.G., Rozovskii, B.L., Blazek, R.B., Hongjoong Kim
• Format: Journal Article
• Language: English
• Published: New York, NY IEEE 01.09.2006; Institute of Electrical and Electronics Engineers; The Institute of Electrical and Electronics Engineers, Inc. (IEEE)
• Subjects: Adaptive systems; Algorithms; Applied sciences; Attack detection; change point detection; Computer crime; Computer networks; Computer vision; denial of service; Exact sciences and technology; Fixed rates; Fluctuations; Information, signal and communications theory; Intrusion detection; Intrusion detection systems; Large-scale systems; man-in-the-middle; Mathematical models; Miscellaneous; network security; network traffic; Networks; nonparametric detection; Pattern recognition; port scanning; sequential tests; service survivability; Signal processing; Statistical analysis; Studies; TCP (protocol); Telecommunication traffic; Telecommunications and information theory; Testing; Traffic engineering; Traffic flow; worm; change point detection; Change detection; Threshold detection; Change point; intrusion detection; Intruder detector; Shape detection; Remote sensing; port scanning; Statistical test; Computer network; service survivability; Sequential method; man-in-the-middle; nonparametric detection; Learning algorithm; Computer security; Telecommunication security; Computer attack; Data analysis; Test statistic; network security; worm; Transmission protocol; Teletraffic; Sequential detection; False alarm rate; Statistical method; network traffic; sequential tests; Surveillance; Attack detection; Statistical model; Batch process; Network protocol; Signal processing; Feature extraction; Denial of service; Edge detection; Remote supervision
• ISSN: 1053-587X; 1941-0476
• DOI: 10.1109/TSP.2006.879308

Large-scale computer network attacks in their final stages can readily be identified by observing very abrupt changes in the network traffic. In the early stage of an attack, however, these changes are hard to detect and difficult to distinguish from usual traffic fluctuations. Rapid response, a minimal false-alarm rate, and the capability to detect a wide spectrum of attacks are the crucial features of intrusion detection systems. In this paper, we develop efficient adaptive sequential and batch-sequential methods for an early detection of attacks that lead to changes in network traffic, such as denial-of-service attacks, worm-based attacks, port-scanning, and man-in-the-middle attacks. These methods employ a statistical analysis of data from multiple layers of the network protocol to detect very subtle traffic changes. The algorithms are based on change-point detection theory and utilize a thresholding of test statistics to achieve a fixed rate of false alarms while allowing us to detect changes in statistical models as soon as possible. There are three attractive features of the proposed approach. First, the developed algorithms are self-learning, which enables them to adapt to various network loads and usage patterns. Secondly, they allow for the detection of attacks with a small average delay for a given false-alarm rate. Thirdly, they are computationally simple and thus can be implemented online. Theoretical frameworks for detection procedures are presented. We also give the results of the experimental study with the use of a network simulator testbed as well as real-life testing for TCP SYN flooding attacks