One recent trend in network security attacks is an increasing number of indirect attacks which influence network traffic negatively, instead of directly entering a system and damaging it. In future, damages from this type of attack are expected to become more serious. In addition, the bandwidth consumption by these attacks influences the entire network performance. This paper presents an abnormal network traffic detecting method and a system prototype. By aggregating packets that belong to the identical flow, we can reduce processing overhead in the system. We suggest a detecting algorithm using changes in traffic patterns that appear during attacks. This algorithm can detect even mutant attacks that use a new port number or changed payload, while signature-based systems are not capable of detecting these types of attacks. Furthermore, the proposed algorithm can identify attacks that cannot be detected by examining only single packet information.
Myung et al REF suggests that by aggregating packets of the identical flow, one can identify the abnormal traffic patterns that appear during an attack.
A flow-based method for abnormal network traffic detection
2004 IEEE/IFIP Network Operations and Management Symposium (IEEE Cat. No.04CH37507)
2004 IEEE/IFIP Network Operations and Management Symposium (IEEE Cat. No.04CH37507)
Computer Science