anomaly detection: feature calculation problem [closed]

Question

I have a question about how to calculate features selected in [ 1 ]. It assumes that the impact of DoS attack on features are nSrcs=nDsts=1, nPkts/sec>a, nSYN/Pkts>b, ... (Table 1 of [ 1 ])

Number of sources (nSrcs) and number of destination (nDsts) and other features are calculated for each aggregated flow according to destination IP (IPdst) in this case, in a time slot. (Section 5.1 of [ 1 ])

But how is it possible for a web server which receives lots of flows from different sources (nSrcs>1) to match with the mentioned DoS criteria. Maybe I don't understand what aggregation means here.

Reference: [ 1 ] Pedro Casas, Johan Mazel, Philippe Owezarski, Unsupervised Network Intrusion Detection Systems: Detecting the Unknown without Knowledge, Computer Communications, 2012.

Edit: Available at here. (This manuscript differs from the published one a little bit)

Edit: I asked the author, and answered this way:

"Everything is wrong with your reasonning as you consider basic traffic figures and not statistical figures. First, you need to learn about what an anomaly or a DoS attack is. Then, you have to learn about traffic statistics in the Internet... There are many papers on this written during the two last decades. Read them first."

what are statistical figures of network traffic?

Answer 1

If you are asking: "With regards to IDS monitoring, what are "traffic statistics" and where can I learn about them? (whitepapers etc)"... then I think the answer you seek is in the whitepaper itself. And there is a picture that illustrates this concept on the top of page 3.

2. Related Work & Contributions

/Snip...

The problem of network anomaly detection has been extensively studied during the last decade. Most approaches analyze statistical variations of traffic volume descriptors (e.g., no. of packets, bytes, or new flows) and/or par- ticular traffic features (e.g., distribution of IP addresses and ports), using either single link measurements or net- work wide data. A non-exhaustive list of standard meth- ods includes the use of signal processing techniques (e.g., ARIMA modeling, wavelets-based filtering) on single-link traffic measurements [9], Kalman filters [12] for network- wide anomaly detection, and Sketches applied to IP-flows [14, 15].

[9] P. Barford, J. Kline, D. Plonka, and A. Ron, “A Signal Analysis of Network Traffic Anomalies”, in Proc. ACM IMW, 2002.

[12] A. Soule, K. Salamatian, and N. Taft, “Combining Filtering and Statistical Methods for Anomaly Detection”, in Proc. ACM IMC, 2005.

[14] B. Krishnamurthy, S. Sen, Y. Zhang, and Y. Chen, “Sketch- based Change Detection: Methods, Evaluation, and Applica- tions”, in Proc. ACM IMC, 2003.

[15] G. Dewaele, K. Fukuda, P. Borgnat, P. Abry, and K. Cho, “Ex- tracting Hidden Anomalies using Sketch and non Gaussian Multi- resolution Statistical Detection Procedures”, in Proc. LSAD, 2007.

If you find links for any of those whitepapers, kindly add them as a comment to this answer; I'd be curious about reading them.

Answer 2

In table 1 of the paper, the authors describe the characteristics of different types of attacks. Some of them have nSrcs=1, some don't. Specifically, what they classify as a DOS attack has NSrcs=1.

You ask "but what if there are two sources?". Well, then you have what they classify as a DDOS, where the definition includes nSrcs > 1.

Now, in practical information security we don't use those exact definitions (we consider DDOS as a subset of DOS, and to have more attributes than just nSrcs>1), which perhaps explains your confusion, but if they need to classify attacks that way for their paper, then fair enough.

Practical classifications of anything are, inevitably, likely to be a bit mushy around the edges, and need tightening up if you're going to do some maths with them.