Networking and Communication Engineering

Rania A. Ghazy ¹, El-Sayed M. El-Rabaie ², Moawad I. Dessouky ², Nawal A. El-Feshawy ³, Fathi E. Abd El-Samie ³

Affiliations
1 Department of Electronics and Communications, Menoufia University, Menouf, EG
2 Department of Electronics and Communications, Menoufia University, Menouf-32952, EG
3 Department of Electronics and Communications, Menoufia University, Menouf-32952, EG

Abstract

Intrusions and attacks have become a very serious problem in network world. This paper presents a statistical characterization of packet counts that can be used for network intrusion detection. The main idea is based on detecting any suspicious behavior in computer networks depending on the comparison between the correlation results of control and data planes in the presence and absence of attacks using histogram analysis. Signal processing tools such as median filtering, moving average filtering, and local variance estimators are exploited to help in developing network anomaly detection approaches. Therefore, detecting dissimilarity can indicate an abnormal behavior.

Keywords

Anomaly Detection, Statistics, Network Intrusion Detection Systems (NIDS).

Full Text

     

Rania A. Ghazy ¹, El-Sayed M. El-Rabaie ², Moawad I. Dessouky ², Nawal A. El-Feshawy ², Fathi E. Abd El-Samie ²

Affiliations
1 Menoufia University, Menouf, EG
2 Department of Electronics and Communications, Menoufia University, Menouf-32952, EG

Abstract

This Paper proposes a network based intrusion detection approach using anomaly detection in the presence of Denial of Service attacks (DoS). Flood based attacks are a common class of DoS attacks. DoS detection mechanisms that aim at detecting floods mainly look for sudden changes in the traffic and mark them anomalous. In this approach, network traffic is decomposed into control and data planes to study the relationship between them. As the data traffic generation is based on control traffic, the behavior of the two planes is expected to be similar during normal behavior. Therefore, detecting dissimilarity between the traffic of the two planes can indicate an abnormal behavior. Toward that objective, an Auto Regressive (AR) model has been used. Simulation results show that both the accuracy of the detection and less false positives.

Keywords

Auto Regressive (AR), Denial-of-Service (DoS), Network Intrusion Detection Systems (NIDS).

Full Text