Anomaly Detection of Network Traffic Based on Prediction and Self-Adaptive Threshold

Transcription

1 Ieraoal Joural of Fuure Geerao Coucao ad eworkg Vol. 8, o. 6 (15), pp hp://d.do.org/1.1457/fgc Aoaly Deeco of ework raffc Based o Predco ad Self-Adapve hreshold Haya Wag Depare of Iforao Egeerg, Bzhou Uversy, Bzhou, Shadog, Cha, 566 Hayawag_631@16.co Absrac Secury probles wh ework are sgfca, such as ework falures ad alcous aacks. Moorg ework raffc ad deec aoales of ework raffc s oe of he effecve aer o esure ework secury. I hs paper, we propose a hybrd ehod for ework raffc predco ad aoaly deeco. Specfcally, he orgal ework raffc daa s decoposed o hgh-frequecy copoes ad low-frequecy copoes. he, o-lear odel Relevace Vecor Mache (RVM) odel ad ARMA (Auo Regressve Movg Average) odel are eployed respecvely for predco. Afer cobg he predco, a self-adapve hreshold ehod based o Ceral L heore (LC) s roduced for aoaly deeco. Moreover, our eesve eperes evaluae he effcecy of proposed ehod. Keywords: ework raffc predco, Aoaly deeco, Wavele decoposo, Ceral L heore 1. Iroduco Wh he develope of Iere ad he creasg of busesses, secury probles wh ework have bee sgfca owadays. ework falures ad alcous aacks could corbue o aoales of ework raffc [1]. herefore, how o effecvely oor ework raffc ad deec aoales of ework raffc has bee pora ework aagee. ework raffc s ypcally colleced as e seres, ad reveals he sascs characerscs ad varaos. As a usable e seres daa, lear odels such as Auoregressve Movg Average (ARMA), Corolled AuoRegressve (CAR) [], or Auoregressve Iegrag Movg Average (ARIMA) [3] cao coprehesvely reflec he characerscs of ework raffc, ad herefore, he predco accuracy s relavely poor. herefore, sple sascal odels are o good eough for ework raffc predco. I hs paper, we propose a hybrd ehod for ework raffc predco ad aoaly deeco. Specfcally, he orgal ework raffc daa s decoposed o wo copoes usg wavele aalyss [4], ha s, hgh-frequecy copoes ad lowfrequecy copoes. For hgh-frequecy copoes, he regulary ad perodcy are relavely weak ad hus sll o-lear. herefore, o-lear odel Relevace Vecor Mache (RVM) [5] s appled for predco. For low-frequecy copoes, he sequece s relavely sable, ad herefore, ARMA (Auo Regressve Movg Average) odel s eployed. he, cobe above wo predco resuls for boh copoes we ge he fal predco for he orgal ework raffc sequece. he, we eploy a self-adapve hreshold ehod o deec f a predced value s a aoaly. Specfcally, he hreshold s dyacally deered by he Ceral L heore (CL) [6] based o he cofdece erval over he ework raffc e seres sequece daa. ISS: IJFGC Copyrgh c 15 SERSC

2 Ieraoal Joural of Fuure Geerao Coucao ad eworkg Vol. 8, o. 6 (15) he rea of hs paper s orgazed as follows. Seco provdes soe relaed work. I Seco 3, we prese our proposed odel for ework raffc predco, ad Seco 4, we descrbe he deeco of aoales. Eprcal eperes are coduced Seco 5. Fally, he paper s cocluded Seco 6.. Relaed Work Esg effors o ework raffc aoaly deeco clude sascs based ehods ad ache learg based ehods. he frs caegory s sascs based ehods. For eaple, hoa [7] capured he aoaly hrough he burs of assocao paers of MIB varables. Wag [8] deeced e seres burs by he oparaerc cuulave suary ehod. Barford [9] appled wavele aalyss o ework raffc aoaly deeco. K [1] eed wavele aalyss o IP package daa aoaly deeco. Galeao [11] eployed ARMA odel for aoaly deeco. he, Asrul [1] roduced ARMIA odel for predcg raffc ad deec aoaly. Brauckhoff [13] eployed PCA aalyss for raffc aoaly deeco. he secod caegory s ache learg based ehods. For eaple, sa [14] used k-eas cluserg o group he orgal daa o several clusers, ad he fd ou he obecs wh au devao. Su [15] roduced K (K-eares eghbor) for for ole aoaly ework raffc defcao. Sors [16] eployed SVM (Suppor Vecor Maches) for classfcao. Ye [17] appled decso rees o lear a se of classfcao rules. Iellgece algorhs such as GA (Geec Algorh) [18] are also appled for raffc aoaly deeco. I hs paper, we propose a hybrd ehod o solve he ework raffc predco proble. 3. ework raffc Predco Model he basc dea for ework raffc predco s o frs perfor wavele decoposo o rasfor he orgal ework raffc sequece o hgh-frequecy copoes ad low-frequecy copoes. Afer dealg wh each copoe respecvely, he fal predco s cobed for he orgal ework raffc sequece. he workflow of ework raffc predco s llusraed Fgure 1. he subseque secos wll dscuss each sep deals. Fgure 1. Workflow of ework raffc Predco 6 Copyrgh c 15 SERSC

3 Ieraoal Joural of Fuure Geerao Coucao ad eworkg Vol. 8, o. 6 (15) 3.1. Wavele Decoposo rasfor he orgal ework raffc sequece S usg wavele decoposo o ul-scale sequeces, ha s, hgh-frequecy copoes ad low-frequecy copoes. Wavele rasforao s he er produc of a square egrable fuco f ( ) ad a wavele fuco ( ) : W f 1 b a b f f d a b (, ), ( ) *, a a, (1) where deoes er produc, a s he scalg facor, b s he shfg facor, * deoes cople cougae, ad ( ) s he wavele, ad 1 b a ( ) b a a a, b,. () Adusg he value of a could eher eed ( a 1 ) or shrk ( 1 a ) ( ) a, b, ad adusg b would affec he aalyss resuls of f ( ) aroud b. he values of a, b are relaed o he fors of ( ) followg codos:. ( ) s he oher wavele fuco, ad sasfes ( ) d, or ( ) d C, (3) Where ( ) s he Fourer rasforao of ( ). ypcally, dscrezao s perfored o a, b : a, b b a a, (4) W Where, are egers, b 1 s a cosa. herefore, he dscree wavele fuco s represeed as: 1 b a 1 ( ) a b,. (5) a a a Ad he correspodg wavele rasforao s: f (,,, ) f, f ( ) ( ) d. (6) Specfcally, whe a, b 1, s called bary dscree wavele rasforao. Apply Malla algorh o decopose he orgal sequece o wo copoes. a d 1 1 h a h d 1,,1,...,, (7) where h s he low-pass decoposo fler, h s he hgh-pass decoposo fler, 1 a s low frequecy coeffce, ad d s hgh frequecy coeffce. Whe deoes he orgal sequece S., Copyrgh c 15 SERSC 7

4 Ieraoal Joural of Fuure Geerao Coucao ad eworkg Vol. 8, o. 6 (15) herefore, Malla algorh decoposes he orgal sequece o low frequecy copoe ad hgh frequecy copoe. he forer s he approae copoe, whch reflecs he oule ad red feaures. he laer s he deal copoe, whch reflecs he dyac facors flueces such as rado perurbao. Afer wavele decoposo, we ge he coeffces of low frequecy ad hgh frequecy. he recosruco s perfored as follows: A D g g 1 a d,,1,...,, (8) where g s he low-pass decoposo fler, g s he hgh-pass decoposo fler, 1 A s he low frequecy copoe, ad D s he hgh frequecy copoe. herefore, Gve a e wdow legh w ad sep sze k, for he ework raffc sequece wh w, oaed as S : {,,..., } 1 w, we decopose S o low frequecy ad hgh frequecy copoes. e, we eploy dffere predco ehods for each copoe. 3.. RVM Based Predco We use RVM odel o predc he ework raffc for hgh frequecy copoes. he reaso s ha he hgh frequecy copoe s deed o-lear. As a ache learg echque, RVM s a popular o-lear regresso odel. Copared o SVM, RVM ca avod over learg, reduce he copuao of kerel fuco, ad s ore suable for ole aalyss. Ideed, RVM has bee wdely appled falure deeco [19] ad ework raffc aalyss [] RVM Bascs he basc dea of RVM s o calculae he weghs for Relevace Vecors by azg he poseror probably. If he rag saple s where y s he pu saple egevalues, ad y (, ) K (, ) 1 s he arge varable, he {, }, 1,,..., ω, (9) where K, ) s he kerel fuco, ω,,..., are he weghs, s he ( sze of rag saples, ad s he ose. If ~ (, ), he he lkelhood fuco s ( ) 1, p ( ω, ) ( ) ep Φω, (1) where Φ [ ( ), ( ),..., ( )], 1 avod over-learg, sasfes: ),..., K (, )] ( ) [ K (, 1, ad o p ( ω ) ep, (11) 8 Copyrgh c 15 SERSC

5 Ieraoal Joural of Fuure Geerao Coucao ad eworkg Vol. 8, o. 6 (15) where s super paraeer. Suppose he probably dsrbuo of p ( ) Gaa ( a, b ), p ( ) Gaa ( c, d ) where a 1 ( a ) e d, c, s Gaa dsrbuo, ha s,, ad Gaa 1 a a 1 ab ( a, b ) ( a ) b a e, a, are he shape paraeers of Gaa dsrbuo, b, d are he scalg paraeers. he he poseror probably s: p ( ω, ) p ( ω,, ) p ( ω,, ) (, ), (1) p (, ) where s he poseror covarace, s he ea, ad ( A ) 1, (13) where A,,..., ) s he dagoal ar, ad ( 1 p (, ) p ( ω, 1 / (, ) ) p ( ω ) d ω ep 1, (14) 1 where I A. We eravely esae he au approae soluo of Equao (14). Le he paral dervaves o, be, we ge ew, (15) Where 1, ad s he -h dagoal elee, ad ew ( ). (16) Afer ay eraos of Equaos (15) ad (16), we ge he covergece value of ad he correspodg s called Relevace Vecor., Copyrgh c 15 SERSC 9

6 Ieraoal Joural of Fuure Geerao Coucao ad eworkg Vol. 8, o. 6 (15) 3... RVM Predco Model Fgure. Flow Cha of RVM Predco Model Le he hgh frequecy copoes D, D,..., D } as rag saple, ad we eed { 1 w o predc { D, D,..., D } w 1 w w k gve he ework raffc sequece S : {,,..., } 1 w. Fgure gves he flow cha of RVM predco odel. he seps are as follows. Sep 1: perfor daa oralzao for D, D,..., D } as follows: ˆ { 1 w D ( D ) a( D ) ( D D, (17) 1 ) Ad D ˆ [ 1,1]. Sep : prepare he pu vecor X, l 1 ad he oupu vecor Y k, l 1 X 1 1 k 1 lk lk lk k k, l 1, (18) Y k, l 1 1 k 1 lk 1 k lk k k k ( l 1 ), (19) where k ( l 1) w, ad ra he RVM odel. 1 Copyrgh c 15 SERSC

7 Ieraoal Joural of Fuure Geerao Coucao ad eworkg Vol. 8, o. 6 (15) Sep 3: feed X ] p o he leared RVM odel, ad ge [ w 1 w w he predced value Y [ ], ad perfor verse oralzao o p w 1 w w k ha. For he low-frequecy copoes, we eploy ARMA odel for predco. Cobe he predcos of hgh-frequecy ad low frequecy copoes ogeher, we ge he predced value of ework raffc, deoed as Yˆ. 4. Aoaly Deeco of ework raffc ow we have he predced value of ework raffc, ad we eed o deere f s a aoaly. We use a adapve hreshold based ehod hs paper. Bascally, he hreshold s deered by he Ceral L heore based o he cofdece erval over he ework raffc sequece S {,,..., }. he cofdece erval of S s: : 1 w S S ( 1), ( 1), () where s he ea of,, ad S s he ea square devao. herefore, he eprcal hreshold s defed as he rage: herefore, he upper boud s L 3 ( 1) S S 3 ( 1), 3 ( 1). (1) S U 3 ( 1) S, ad lower boud s. he rules of aoaly deeco are as follows: (1) If L Y U, he predced ework raffc s oral; () If L Y U, he observed ework raffc s oral; (3) If Yˆ U or Yˆ L, he aoaly of predced ework raffc s deeced; (4) If Y U or Y L, he aoaly of observed ework raffc s deeced. 5. Epere 5.1. Daase Descrpo he daase we use hs epere s acheved fro he ework raffc lbrary (hp://ewsfeed.cu.e/-ews/6), whch colleced 3 ework raffc daa records per hour fro Augus 1 s o oveber 1 h, 11, oaed as {, 1,,..., 3 }. Forer 5 records are used as rag saple, ad he laer 5 are for esg. Fgure 3 shows he daa. Copyrgh c 15 SERSC 11

8 Ieraoal Joural of Fuure Geerao Coucao ad eworkg Vol. 8, o. 6 (15) 5.. Self-Slary Aalyss Fgure 3. Daa Saple of ework raffc Self-slary ca be easured by Hurs epoe H. If H. 5, he ework raffc sequece s rado, ad here es o relaos bewee eves. If H [,.5 ), he ework raffc sequece s a-persse. If H (.5,1), ework raffc sequece s persse wh self-slary, ad larger H eas ore self-slary. We use rescaled rage aalyss ehod o calculae H : H ( R / S ) A, () Where s he scale of saple daa, R s he rescaled rage, S s he sadard devao, A s a cosa. Fgure 4 gves he log-log plo of ( R / S ) ad. he slope of he fg le for all daa pos are he value of Hurs epoe H. Wh our daase, we have H. 761, whch sasfes H (.5,1). herefore, he ework raffc sequece we use he epere has self-slary characersc. Accordgly, o-lear odel should be eployed for ework raffc predco o reduce he predco error. Fgure 4. Hurs Epoe of ework raffc Daa Saple 5.3. Predco Resuls I order o easure he predco resuls, we roduce Roo Mea Square Error (RMSE) ad Relave Roo Mea Square Error (RRMSE): RMSE 1 ( ˆ ), (3) 1 Copyrgh c 15 SERSC

9 Ieraoal Joural of Fuure Geerao Coucao ad eworkg Vol. 8, o. 6 (15) RRMSE 1 ( ˆ ), (4) where s he observed value, ad ˆ s he predced value. able 1 lss he predco error of proposed ehod copared wh wavele aalyss oly ehod ad ARMA oly odel. We ca observe ha our hybrd ehod ouperfors oher wo wh beer accuracy, ad herefore ca effecvely deec aoales. able 1. Predco Error of ework raffc Mehod RMSE RRMSE Proposed Wavele aalyss ARMA Fgure 5 shows predco resuls for a ercep of he ework raffc sequece. We ca observe ha predco becoes precse whe he eough uber of saples are colleced. I hs case, a aoaly s deeced aroud daa 36~38. Fgure 5. Predco Resuls of ework raffc Besdes, Fgure 6 gves he predco error of RVM odel for hgh-frequecy copoes. Bascally, he predco error s sall eough, ad he predco odel ca f he ework raffc daa prey well. Fgure 6. Predco Error of RVM Model Copyrgh c 15 SERSC 13

10 Ieraoal Joural of Fuure Geerao Coucao ad eworkg Vol. 8, o. 6 (15) 6. Cocluso I hs paper, we sudy o he proble of predcg ework raffc ad deecg ework raffc aoales. Specfcally, we propose a hybrd ehod based o wavele aalyss ad RVM, ad he eploy a hreshold based ehod for aoaly deeco. Besdes, our eperes evaluae he effcecy of our odel. hs work dcaes he feasbly of cobg sascal ehods ad ache learg ehods ogeher. I fuure works, we ll ry o eplore he possbly of cobg ohers for ore eresg applcaos. Refereces [1] A.S. Raer ad P. Kelly, Aoales ework raffc Iellgece ad Secury Iforacs (ISI), 13 IEEE Ieraoal Coferece o. IEEE, (13), pp [] Y. Xao, G. Sog ad Y. Lao, Mul-ovao sochasc grade paraeer esao for pu olear corolled auoregressve odels, Ieraoal Joural of Corol, Auoao ad Syses, vol. 1, o. 3, (1), pp [3] M. Valpour, M. E. Bahabb ad S. M. R. Behbaha, Paraeers Esae of Auoregressve Movg Average ad Auoregressve Iegraed Movg Average Models ad Copare her Ably for Iflow Forecasg Joural of Maheacs ad Sascs, o. 3, (1). [4] C. orrece ad P. Glber Copo, A praccal gude o wavele aalyss. Bulle of he Aerca Meeorologcal socey vol. 79, o. 1, (1998), pp [5] M.E. ppg, Sparse Bayesa learg ad he relevace vecor ache. he oural of ache learg research 1 (1), pp [6] J. Davdso, Esablshg codos for he fucoal ceral l heore olear ad separaerc e seres processes Joural of Ecooercs vol. 16, o., (), pp [7] M. hoa ad C. J, Proacve aoaly deeco usg dsrbued ellge ages [J] ework, IEEE, vol. 1, o. 5, (1998), pp [8] H. W. Dalu, Deecg SY Floodg Aacks, Ifoco, wey-frs Aual Jo Coferece of he IEEE Copuer ad Coucaos Socees, Proceedgs, IEEE, (), pp [9] P. Barford, J. Kle ad D. Ploka, A Sgal Aalyss of ework raffc Aoales I Iere Measuree Workshop, (). [1] S. S. K ad A. L.. Reddy, Sascal echques for Deecg raffc Aoales hrough Packe Header Daa eworkg, IEEE/ACM rasacos o, vol. 16, o. 3, (8), pp [11] P. Galeao, D. Peña ad R. S. say, Ouler Deeco Mulvarae e Seres by Proeco Pursu Joural of he Aerca Sascal Assocao, vol. 11, o. 474, (6), pp [1] A.H. Yaacob, I. K.. a ad S. F. Che, ARIMA Based ework Aoaly Deeco, Coucao Sofware ad eworks, 1. ICCS '1, Secod Ieraoal Coferece, (1), pp [13] D. Brauckhoff, K. Salaaa ad M. May, Applyg PCA for raffc Aoaly Deeco: Probles ad Soluos, IFOCOM 9, IEEE. IEEE, (9), pp [14] C. sa, Y. Hsu ad C. L, Iruso deeco by ache learg: A revew, Eper Syses wh Applcaos, vol. 36, o. 1, (9), pp [15] M. Su, Usg cluserg o prove he K-based classfers for ole aoaly ework raffc defcao, Joural of ework ad Copuer Applcaos, vol. 34, o., (11), pp [16] V. A. Sors, P. W. se ad M. G. Pech, Aoaly Deeco hrough a Bayesa Suppor Vecor Mache, Relably, IEEE rasacos o, vol. 59, o., (1), pp [17] Y. Xaolog, L. Julog ad G. og, ework aoaly deeco ehod based o prcple copoe aalyss ad abu search ad decso ree classfcao, Joural of Copuer Applcaos, vol. 33, o. 1, (13), pp [18] S. Al ad R. Reya, A hybrd ehod based o geec algorh, self-orgazed feaure ap, ad suppor vecor ache for beer ework aoaly deeco, Copug, Coucaos ad eworkg echologes (ICCC), 13 Fourh Ieraoal Coferece o. IEEE, (13), pp [19] C. He, Y. L ad Y. Huag, Relevace Vecor Mache Based Gear Faul Deeco, Paer Recogo, 9. CCPR 9. Chese Coferece o IEEE, (9), pp [] Z. Quhu, Ole ework raffc Classfcao Algorh Based o RVM, Joural of eworks, (13). 14 Copyrgh c 15 SERSC