دانلود مقاله ISI انگلیسی شماره 76905
عنوان فارسی مقاله

ADMIRE: روش تشخیص ناهنجاری با استفاده از PCA مبتنی بر آنتروپی با طرحهای اولیه سه مرحله ای

کد مقاله سال انتشار مقاله انگلیسی ترجمه فارسی تعداد کلمات
76905 2013 14 صفحه PDF سفارش دهید محاسبه نشده
خرید مقاله
پس از پرداخت، فوراً می توانید مقاله را دانلود فرمایید.
عنوان انگلیسی
ADMIRE: Anomaly detection method using entropy-based PCA with three-step sketches
منبع

Publisher : Elsevier - Science Direct (الزویر - ساینس دایرکت)

Journal : Computer Communications, Volume 36, Issue 5, 1 March 2013, Pages 575–588

کلمات کلیدی
PCA؛ Hash - طرح اولیه؛ تشخیص ناهنجاری؛ آنتروپی
پیش نمایش مقاله
پیش نمایش مقاله ADMIRE: روش تشخیص ناهنجاری با استفاده از PCA مبتنی بر آنتروپی با طرحهای اولیه سه مرحله ای

چکیده انگلیسی

Network anomaly detection using dimensionality reduction has recently been well studied in order to overcome the weakness of signature-based detection. Previous works have proposed a method for detecting particular anomalous IP-flows by using random projection (sketch) and a Principal Component Analysis (PCA). It yields promising high detection capability results without needing a pre-defined anomaly database. However, the detection method cannot be applied to the traffic flows at a single measurement point, and the appropriate parameter settings (e.g., the relationship between the sketch size and the number of IP addresses) have not yet been sufficiently studied. We propose in this paper a PCA-based anomaly detection algorithm called ADMIRE to supplement and expand the previous works. The key idea of ADMIRE is the use of three-step sketches and an adaptive parameter setting to improve the detection performance and ease its use in practice. We evaluate the effectiveness of ADMIRE using the longitudinal traffic traces captured from a transpacific link. The main findings of this paper are as follows: (1) We reveal the correlation between the number of IP addresses in the measured traffic and the appropriate sketch size. We take advantage of this relation to set the sketch size parameter. (2) ADMIRE outperforms traditional PCA-based detector and other detectors based on different theoretical backgrounds. (3) The types of anomalies reported by ADMIRE depend on the traffic features that are selected as input. Moreover, we found that a simple aggregation of several traffic features degrades the detection performance.

خرید مقاله
پس از پرداخت، فوراً می توانید مقاله را دانلود فرمایید.