An Information Theoretic Model for Protocol Graph Based Anomaly Analysis

摘要

One of the major problems in network behavior analysis is to discover the underlying patterns from huge amount of network traffic data in order to identify anomalies from the norm. A great deal of work has been conducted through modeling the attribute-value network traffic data into different models. However, the abstract models generated by machine learning or data mining techniques prevent users from understanding the network behaviors very well. Network protocols, e.g., TCP, UDP, define the format of messages and legitimate sequence of the messages. To explicitly bridge the semantic gap between the abstract models and the human recognizable knowledge, we propose a new information theoretic model that utilizes protocol structural information and statistical techniques to analyze the network behaviors. We define new metrics and propose methods to identify unexpected anomalies, incomplete anomalies, and dominant anomalies within the information theoretic model framework. The method is evaluated using real-world network data.