Abnormal Traffcic Detection using Flow-based Traffic Measuring Scheme

摘要

Because Signature-based detection engines only detect known attacks, a signature must be created for every attack, and unknown attacks cannot be detected, for example, zero-day attacks. In this paper, we have introduced the Zero-day Attack Detection System (ZADS) for novel network attack detection. This system provides early detection function and validation of attack at the moment the attacks start to spread on the network. Especially, we classify the suspicious flow from the normal through the flow-based traffic measuring scheme based on hardware-based accelerator. In this paper, after we setup the ZADS to real test-bed, we have analyzed the results of the ZADS about detection of unknown attack.