Detecting network cyber-attacks using an integrated statistical approach
Type
ArticleKAUST Department
Computer, Electrical and Mathematical Sciences and Engineering (CEMSE) DivisionEnvironmental Statistics Group
Statistics Program
Date
2020-11-07Online Publication Date
2020-11-07Print Publication Date
2021-06Embargo End Date
2021-11-07Permanent link to this record
http://hdl.handle.net/10754/665962
Metadata
Show full item recordAbstract
Anomaly detection in the Internet of Things (IoT) is imperative to improve its reliability and safety. Detecting denial of service (DOS) and distributed DOS (DDOS) is one of the critical security challenges facing network technologies. This paper presents an anomaly detection mechanism using the Kullback–Leibler distance (KLD) to detect DOS and DDOS flooding attacks, including transmission control protocol (TCP) SYN flood, UDP flood, and ICMP-based attacks. This mechanism integrates the desirable properties of KLD, the capacity to quantitatively discriminate between two distributions, with the sensitivity of an exponential smoothing scheme. The primary reason for exponentially smoothing KLD measurements (ES–KLD) is to aggregate all of the information from past and actual samples in the decision rule, making the detector sensitive to small anomalies. Furthermore, a nonparametric approach using kernel density estimation has been used to set a threshold for ES-KLD decision statistic to uncover the presence of attacks. Tests on three publicly available datasets show improved performances of the proposed mechanism in detecting cyber-attacks compared to other conventional monitoring procedures.Citation
Bouyeddou, B., Harrou, F., Kadri, B., & Sun, Y. (2020). Detecting network cyber-attacks using an integrated statistical approach. Cluster Computing. doi:10.1007/s10586-020-03203-1Publisher
Springer NatureJournal
Cluster ComputingAdditional Links
http://link.springer.com/10.1007/s10586-020-03203-1ae974a485f413a2113503eed53cd6c53
10.1007/s10586-020-03203-1