loading
Papers

Research.Publish.Connect.

Paper

Authors: Gustavo Gonzalez-Granadillo 1 ; Rodrigo Diaz 1 ; Ibéria Medeiros 2 ; Susana Gonzalez-Zarzosa 1 and Dawid Machnicki 1

Affiliations: 1 Atos Research & Innovation, Cybersecurity Laboratory and Spain ; 2 LASIGE, Faculty of Sciences, University of Lisboa and Portugal

ISBN: 978-989-758-378-0

Keyword(s): Machine Learning, One-class SVM, Anomaly Detection, Network Traffic Behavior, NetFlow.

Related Ontology Subjects/Areas/Topics: Data and Application Security and Privacy ; Information and Systems Security ; Information Assurance ; Management of Computing Security ; Network Security ; Security Management ; Security Verification and Validation ; Wireless Network Security

Abstract: Network anomaly detection using NetFlow has been widely studied during the last decade. NetFlow provides the ability to collect network traffic attributes (e.g., IP source, IP destination, source port, destination port, protocol) and allows the use of association rule mining to extract the flows that have caused a malicious event. Despite of all the developments in network anomaly detection, the most popular procedure to detect non-conformity patterns in network traffic is still manual inspection during the period under analysis (e.g., visual analysis of plots, identification of variations in the number of bytes, packets, flows). This paper presents a Live Anomaly Detection System (LADS) based on One class Support Vector Machine (One-class SVM) to detect traffic anomalies. Experiments have been conducted using a valid data-set containing over 1.4 million packets (captured using NetFlow v5 and v9) that build models with one and several features in order to identify the approach that mo st accurately detects traffic anomalies in our system. A multi-featured approach that restricts the analysis to one IP address and extends it in terms of samples (valid and invalid ones) is considered as a promising approach in terms of accuracy of the detected malicious instances. (More)

PDF ImageFull Text

Download
CC BY-NC-ND 4.0

Sign In Guest: Register as new SciTePress user now for free.

Sign In SciTePress user: please login.

PDF ImageMy Papers

You are not signed in, therefore limits apply to your IP address 18.205.60.226

In the current month:
Recent papers: 100 available of 100 total
2+ years older papers: 200 available of 200 total

Paper citation in several formats:
Gonzalez-Granadillo, G.; Diaz, R.; Medeiros, I.; Gonzalez-Zarzosa, S. and Machnicki, D. (2019). LADS: A Live Anomaly Detection System based on Machine Learning Methods.In Proceedings of the 16th International Joint Conference on e-Business and Telecommunications - Volume 2: SECRYPT, ISBN 978-989-758-378-0, pages 464-469. DOI: 10.5220/0007948904640469

@conference{secrypt19,
author={Gustavo Gonzalez{-}Granadillo. and Rodrigo Diaz. and Ibéria Medeiros. and Susana Gonzalez{-}Zarzosa. and Dawid Machnicki.},
title={LADS: A Live Anomaly Detection System based on Machine Learning Methods},
booktitle={Proceedings of the 16th International Joint Conference on e-Business and Telecommunications - Volume 2: SECRYPT,},
year={2019},
pages={464-469},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0007948904640469},
isbn={978-989-758-378-0},
}

TY - CONF

JO - Proceedings of the 16th International Joint Conference on e-Business and Telecommunications - Volume 2: SECRYPT,
TI - LADS: A Live Anomaly Detection System based on Machine Learning Methods
SN - 978-989-758-378-0
AU - Gonzalez-Granadillo, G.
AU - Diaz, R.
AU - Medeiros, I.
AU - Gonzalez-Zarzosa, S.
AU - Machnicki, D.
PY - 2019
SP - 464
EP - 469
DO - 10.5220/0007948904640469

Login or register to post comments.

Comments on this Paper: Be the first to review this paper.