Introduction Statement problem Mathematical background Algorithm Experiments Conclusions Detection and Classification of Anomalies in Network Traffic Using Generalized Entropies and OC-SVM with Mahalanobis Kernel Jayro Santiago-Paz, Deni Torres-Roman, Angel Figueroa-Ypiña. Cinvestav, Campus Guadalajara November 2014 Jayro Santiago-Paz, et al. 1/18 Detection and Classification of Anomalies in Network Traffic
Introduction Statement problem Mathematical background Algorithm Experiments Conclusions Outline Introduction 1 Statement problem 2 Mathematical background 3 Algorithm 4 Experiments 5 Conclusions 6 Jayro Santiago-Paz, et al. 2/18 Detection and Classification of Anomalies in Network Traffic
Introduction Statement problem Mathematical background Algorithm Experiments Conclusions Outline Introduction 1 Statement problem 2 Mathematical background 3 Algorithm 4 Experiments 5 Conclusions 6 Jayro Santiago-Paz, et al. 2/18 Detection and Classification of Anomalies in Network Traffic
Introduction Statement problem Mathematical background Algorithm Experiments Conclusions Outline Introduction 1 Statement problem 2 Mathematical background 3 Algorithm 4 Experiments 5 Conclusions 6 Jayro Santiago-Paz, et al. 2/18 Detection and Classification of Anomalies in Network Traffic
Introduction Statement problem Mathematical background Algorithm Experiments Conclusions Outline Introduction 1 Statement problem 2 Mathematical background 3 Algorithm 4 Experiments 5 Conclusions 6 Jayro Santiago-Paz, et al. 2/18 Detection and Classification of Anomalies in Network Traffic
Introduction Statement problem Mathematical background Algorithm Experiments Conclusions Outline Introduction 1 Statement problem 2 Mathematical background 3 Algorithm 4 Experiments 5 Conclusions 6 Jayro Santiago-Paz, et al. 2/18 Detection and Classification of Anomalies in Network Traffic
Introduction Statement problem Mathematical background Algorithm Experiments Conclusions Outline Introduction 1 Statement problem 2 Mathematical background 3 Algorithm 4 Experiments 5 Conclusions 6 Jayro Santiago-Paz, et al. 2/18 Detection and Classification of Anomalies in Network Traffic
Introduction Statement problem Mathematical background Algorithm Experiments Conclusions Network Intrusion Detection Systems (NIDS) Signature-NIDS . Use a database with attack signatures. 1 Anomaly-NIDS . Classify the traffic in normal and abnormal to 2 decide if an attack has occurred. Uses network features such as destination and source IP Addresses and Port, packet size, number of flows, and amount of packets between hosts. A class of Anomaly-NIDS is the entropy-based approach, which: Provide more information about the structure of anomalies than traditional traffic volume analysis. Capture the degree of dispersal or concentration of the distributions for different traffic features. Jayro Santiago-Paz, et al. 3/18 Detection and Classification of Anomalies in Network Traffic
Introduction Statement problem Mathematical background Algorithm Experiments Conclusions Statement problem Let ψ be an Internet traffic data trace and p the number of ran- dom variables X i representing the traffic features. Using entropy of these traffic features we can find a region that characterize the feature behavior of the trace in the feature space. If ψ was obtained during “normal” network behavior, this region R N will serve to detect anomalies. If ψ was captured while network attack occurred, the defined region R A characterizes the anomaly Jayro Santiago-Paz, et al. 4/18 Detection and Classification of Anomalies in Network Traffic
Introduction Statement problem Mathematical background Algorithm Experiments Conclusions Approach Our approach for define the “normal” R N or abnormal region R A in the space is to use Mahalanobis distance to define regular regions (i.e. hyperellipsoids) and OC-SVM which allows finding a non-regular region based on the support vectors. Figure 1: Different regions based on different methods and metrics. Jayro Santiago-Paz, et al. 5/18 Detection and Classification of Anomalies in Network Traffic
Introduction Statement problem Mathematical background Algorithm Experiments Conclusions Entropy Let X be a r.v. that take values of the set { x 1 , x 2 , ..., x M } , p i := P ( X = x i ) the probability of occurrence of x i . M ˆ � H S ( P ) = − p i logp i . (1) i =1 M 1 ˆ � p q H R ( P, q ) = 1 − qlog ( i ) (2) i =1 M 1 H T ( P, q ) = ˆ � p q q − 1(1 − i ) (3) i =1 where P is a probability distribution and the parameter q is used to make less or more sensitive the entropy to certain events within the distribution. Jayro Santiago-Paz, et al. 6/18 Detection and Classification of Anomalies in Network Traffic
Introduction Statement problem Mathematical background Algorithm Experiments Conclusions Mahalanobis distance d 2 = ( x − ¯ x ) T S − 1 ( x − ¯ x ) . (4) An unbiased sample covariance matrix is N 1 � ′ , S = ( x i − ¯ x )( x i − ¯ x ) (5) N − 1 i =1 where the sample mean is N x = 1 � ¯ x i . (6) N i =1 Jayro Santiago-Paz, et al. 7/18 Detection and Classification of Anomalies in Network Traffic
Introduction Statement problem Mathematical background Algorithm Experiments Conclusions OC-SVM N 1 1 2 � w � 2 + � min ξ i − b (7) νN w ∈ F,b ∈ R , ξ ∈ R N i Decision function � N � � f ( x ) = sgn α i k ( x i , x ) − b , (8) i Mahalanobis Kernel k ( x , y ) = exp ( − η ′ S − 1 ( x − y )) , p ( x − y ) (9) where p is the number of features, η is a control parameter of the resulting boundary, and S is defined in (5). Jayro Santiago-Paz, et al. 8/18 Detection and Classification of Anomalies in Network Traffic
Introduction Statement problem Mathematical background Algorithm Experiments Conclusions Training ¯ ¯ H ( X p ¯ H ( X 1 H ( X 2 1 ) 1 ) · · · 1 ) ¯ ¯ H ( X p ¯ H ( X 1 H ( X 2 2 ) 2 ) · · · 2 ) H m × p = , . . . . . . . . . . . . ¯ ¯ ¯ H ( X 1 H ( X 2 H ( X p m ) m ) · · · m ) MD method LT = ( ( m − 1) 2 ) β [ α,p/ 2 , ( m − p − 1) / 2] , where β [ α,p/ 2 , ( m − p − 1) / 2] m represents a beta distribution. The mean vector ¯ x = { ¯ x 1 , ¯ x 2 , ..., ¯ x p } . The matrix equation S γ = λγ is solved. { LT, ¯ x , γ , λ } . Jayro Santiago-Paz, et al. 9/18 Detection and Classification of Anomalies in Network Traffic
Introduction Statement problem Mathematical background Algorithm Experiments Conclusions Training ¯ ¯ H ( X p ¯ H ( X 1 H ( X 2 1 ) 1 ) · · · 1 ) ¯ ¯ H ( X p ¯ H ( X 1 H ( X 2 2 ) 2 ) · · · 2 ) H m × p = , . . . . . . . . . . . . ¯ ¯ H ( X p ¯ H ( X 1 H ( X 2 m ) m ) · · · m ) OC-SVM method The equation (7) is solved using two different kernel func- tions (Radial Basis Function (RBF) and Mahalanobis ker- nel(MK)). { x i = sv i , α i , b } , where x i = sv i is the i -support vector, α i , b are constants that solve the equation (7). Jayro Santiago-Paz, et al. 10/18 Detection and Classification of Anomalies in Network Traffic
Introduction Statement problem Mathematical background Algorithm Experiments Conclusions Detection � ¯ i ) , ¯ i ) , · · · , ¯ H ( X p H ( X 1 H ( X 2 � h i = i ) . (10) The decision function for MD region is given by (4), if d 2 i ≤ LT then i − slot is considered “normal” otherwise is a potential anomaly. The decision function for OC-SVM is (8), if the function is +1 then h i is considered “normal” otherwise is a potential anomaly. Jayro Santiago-Paz, et al. 11/18 Detection and Classification of Anomalies in Network Traffic
Introduction Statement problem Mathematical background Algorithm Experiments Conclusions Classification If the vector (10) is out of the “normal” region, i.e h i / ∈ R N , but h i ∈ R A the abnormal behavior, then it will be classified. Here h i is evaluated with all decision functions defined in the training stage. The classification is refined using the k-nearest neighbors algorithm to insure that a point belongs to a specific class. Jayro Santiago-Paz, et al. 12/18 Detection and Classification of Anomalies in Network Traffic
Introduction Statement problem Mathematical background Algorithm Experiments Conclusions Datasets LAN MIT-DARPA Normal ( β 1 ). Normal ( β 2 ). port scan ( ψ 1 ). Smurf worm ( ψ 5 ). Blaster worm ( ψ 2 ). Neptune worm ( ψ 6 ). Sasser worm ( ψ 3 ). Pod worm( ψ 7 ). Welchia worm( ψ 4 ). port sweep ( ψ 8 ). Jayro Santiago-Paz, et al. 13/18 Detection and Classification of Anomalies in Network Traffic
Introduction Statement problem Mathematical background Algorithm Experiments Conclusions Anomaly detection Figure 2: Estimated entropy of IP Figure 3: Estimated entropy of IP addresses from LAN traces. addresses from MIT-DARPA traces. Jayro Santiago-Paz, et al. 14/18 Detection and Classification of Anomalies in Network Traffic
Recommend
More recommend
