Improving Network Traffic Anomaly Detection for Cloud Computing Services

Publikation: Beitrag zu KonferenzenPaperBeigetragenBegutachtung

Beitragende

  • Ana Cristina Oliveira - (Autor:in)
  • Marco Spohn - (Autor:in)
  • Reinaldo Gomes - (Autor:in)
  • Do Le Quoc - (Autor:in)
  • Breno Jacinto Duarte - (Autor:in)

Abstract

Efficient network traffic anomaly detection is a widely studied problem on avoiding attacks and unwanted use of communication infrastructures. Existing techniques to detect, prevent or monitor these attacks are usually based on known thresholds, on the construction of profiles of normal traffic patterns, or on signature pattern matching of anomalous behavior (i.e., viruses and attacks). On the other hand, there are dynamic techniques that strive to predict the system's clutter degree; i.e., the system entropy, supposing that outliers translate to anomalies. We have developed and analyzed the accuracy of a network anomaly detector for Cloud Computing Systems based on the entropy of network traffic metrics. Although entropy-based solutions do not suppose hard knowledge of the system, the results point out to the need for more accurate adjustment of system parameters, taking into consideration the nature of the data, frequency of events, and the variation of metric values. To improve the results, unsupervised machine learning algorithms were added to the anomaly detection process.

Details

OriginalspracheEnglisch
Seiten107 to 113
PublikationsstatusVeröffentlicht - 2014
Peer-Review-StatusJa

Konferenz

TitelNinth International Conference on Systems and Networks Communications
KurztitelINSNC 2014
Veranstaltungsnummer9
Dauer12 - 16 Oktober 2014
BekanntheitsgradInternationale Veranstaltung
StadtNice
LandFrankreich

Schlagworte

Forschungsprofillinien der TU Dresden

DFG-Fachsystematik nach Fachkollegium

Schlagwörter

  • Network traffic anomaly detection, Cloud Computing, Machine learning, entropy, Entropy