Detecting network cyber-attacks using an integrated statistical approach
KAUST DepartmentComputer, Electrical and Mathematical Sciences and Engineering (CEMSE) Division
Environmental Statistics Group
Embargo End Date2021-11-07
Permanent link to this recordhttp://hdl.handle.net/10754/665962
MetadataShow full item record
AbstractAnomaly detection in the Internet of Things (IoT) is imperative to improve its reliability and safety. Detecting denial of service (DOS) and distributed DOS (DDOS) is one of the critical security challenges facing network technologies. This paper presents an anomaly detection mechanism using the Kullback–Leibler distance (KLD) to detect DOS and DDOS flooding attacks, including transmission control protocol (TCP) SYN flood, UDP flood, and ICMP-based attacks. This mechanism integrates the desirable properties of KLD, the capacity to quantitatively discriminate between two distributions, with the sensitivity of an exponential smoothing scheme. The primary reason for exponentially smoothing KLD measurements (ES–KLD) is to aggregate all of the information from past and actual samples in the decision rule, making the detector sensitive to small anomalies. Furthermore, a nonparametric approach using kernel density estimation has been used to set a threshold for ES-KLD decision statistic to uncover the presence of attacks. Tests on three publicly available datasets show improved performances of the proposed mechanism in detecting cyber-attacks compared to other conventional monitoring procedures.
CitationBouyeddou, B., Harrou, F., Kadri, B., & Sun, Y. (2020). Detecting network cyber-attacks using an integrated statistical approach. Cluster Computing. doi:10.1007/s10586-020-03203-1