A distributed approach to network anomaly detection based on independent component analysis

摘要

Network anomalies, circumstances in which the network behavior deviates from its normal operational baseline,rncan be due to various factors such as network overload conditions, malicious/hostile activities, denialrnof service attacks, and network intrusions. New detection schemes based on machine learning principles arerntherefore desirable as they can learn the nature of normal traffic behavior and autonomously adapt to variationsrnin the structure of ‘normality’ as well as recognize the significant deviations as suspicious or anomalousrnevents. The main advantages of these techniques are that, in principle, they are not restricted to any specificrnenvironment and that they can provide a way of detecting unknown attacks. Detection performance is directlyrncorrelated with the traffic model quality, in terms of ability of representing the traffic behavior from its mostrncharacterizing internal dynamics. Starting from these ideas, we developed a two-stage anomaly detectionrnstrategy based on multiple distributed sensors located throughout the network. By using Independent ComponentrnAnalysis, the first step, modeled as a Blind Source Separation problem, extracts the fundamentalrntraffic components (the ‘source’ signals), corresponding to the independent traffic dynamics, from the multidimensionalrntime series incoming from the sensors, corresponding to the perceived ‘mixed/aggregate’ effectrnof traffic on their interfaces. These components will be used to build the baseline traffic profiles needed inrnthe second supervised phase, based on a binary classification scheme (detection is casted into an anomalous/rnnormal classification problem) driven by machine learning-inferred decision trees.