Improving Network Traffic Anomaly Detection for Cloud Computing Services

Research output: Contribution to conferencesPaperContributedpeer-review

Contributors

  • Ana Cristina Oliveira - (Author)
  • Marco Spohn - (Author)
  • Reinaldo Gomes - (Author)
  • Do Le Quoc - (Author)
  • Breno Jacinto Duarte - (Author)

Abstract

Efficient network traffic anomaly detection is a widely studied problem on avoiding attacks and unwanted use of communication infrastructures. Existing techniques to detect, prevent or monitor these attacks are usually based on known thresholds, on the construction of profiles of normal traffic patterns, or on signature pattern matching of anomalous behavior (i.e., viruses and attacks). On the other hand, there are dynamic techniques that strive to predict the system's clutter degree; i.e., the system entropy, supposing that outliers translate to anomalies. We have developed and analyzed the accuracy of a network anomaly detector for Cloud Computing Systems based on the entropy of network traffic metrics. Although entropy-based solutions do not suppose hard knowledge of the system, the results point out to the need for more accurate adjustment of system parameters, taking into consideration the nature of the data, frequency of events, and the variation of metric values. To improve the results, unsupervised machine learning algorithms were added to the anomaly detection process.

Details

Original languageEnglish
Pages107 to 113
Publication statusPublished - 2014
Peer-reviewedYes

Conference

TitleNinth International Conference on Systems and Networks Communications
Abbreviated titleINSNC 2014
Conference number9
Duration12 - 16 October 2014
Degree of recognitionInternational event
CityNice
CountryFrance

Keywords

Research priority areas of TU Dresden

DFG Classification of Subject Areas according to Review Boards

Keywords

  • Network traffic anomaly detection, Cloud Computing, Machine learning, entropy, Entropy