Anomaly Detection

[computer girl]

Anomaly Detection


  Anomaly Detection.ppt (Size: 341 KB / Downloads: 1)

What is Anomaly Detection

Detection of deviation from what is consider ( or from its normal behavior)
Capable of detecting Novel attacks or new attacks
Identify a activity that are different from users or a system normal behavior
To detect unauthorized attempts to access the system

Sources of Network Data

Network probes
Packet filtering
Gathering information from router
Monitoring activity of specific user
monitoring memory and N/W usage
etc….

Packet Header Anomaly Detection

Trained on attack free traffic
Checking anomaly field of packet header.
Link Layer
Network Layer
Transport Layer
The model detect novel attacks.
Split large field
Merge small field
During training record each value of fields

ADWICE

This technique deal with massive data
Efficient data structure.
New search Index.
Dynamic nature of normal request and services.
Use clustering for training data.
Where similar data point group together into cluster. Cluster using a distance function for identify closest cluster.
ADWICE store cluster feature in main memory instead of all training data points.