On the use of co-occurrence matrices for network anomaly detection

ABSTRACT

In the last few years the number and impact of security attacks over the Internet have been continuously increasing. Since it is impossible to guarantee complete protection to a system by means of the "classical" prevention mechanisms, the use of Intrusion Detection Systems (IDSs) has emerged as a key element in network security. In this paper we address the problem considering some techniques for detecting network anomalies, based on the use of co-occurrence matrices, to model the "normal" behavior of the TCP connections.

The performance analysis, shows a comparison among the different solutions, which demonstrates the effectiveness of the proposed methods.

REFERENCES

• 1: M. Turk and A. Pentland, "Face recognition using eigenfaces," in Proc. of IEEE Computer Society Conference on Computer Vision and Pattern Recognition, (CVPR), 1991.
• 2: Matthew Turk , Alex Pentland, Eigenfaces for recognition, Journal of Cognitive Neuroscience, v.3 n.1, p.71-86, Winter 1991 [doi>10.1162/jocn.1991.3.1.71]
• 3: A. Pentland, B. Moghaddam, and T. Starner, "View-based and modular eigenspaces for face recognition," in Proc. of IEEE Computer Society Conference on Computer Vision and Pattern Recognition (CVPR), 1994.
• 4: M. Oka, Y. Oyama, H. Abe, and K. Kato, "Anomaly detection using layered networks based on eigen co-occurrence matrix," in Proc. of the International Symposium on Recent Advances in Intrusion Detection (RAID), pp. 223--237, 2004.
• 5: M. Oka, Y. Oyama, and K. Kato, "Eigen co-occurrence matrix method for masquerade detection," in Proc. of the 7th JSSST SIGSYS Workshop on Systems for Programming and Applications (SPA), 2004.
• 6: R. Haralick, Dinstein, and K. Shanmugam, "Textural features for image classification," IEEE Transactions on Systems, Man, and Cybernetics, vol. SMC-3, pp. 610--621, 1973.
• 7: R. Walker, P. Jackway, and D. Longstaff, "Recent developments in the use of the co-occurrence matrix for texture recognition," in Proc. of the 13th International Conference on Digital Signal Processing (ICDSP), 1997.
• 8: D. Benedetto, E. Caglioti, and V. Loreto, "Language trees and zipping," Physical Review Letters, vol. 88, January 2002.
• 9: A. Puglisi, "Data compression and learning in time sequences analysis," 2002.
• 10: "MIT, Lincoln laboratory, DARPA evaluation intrusion detection." http://www.ll.mit.edu/IST/ideval/ (accessed on 2008/06/28).
• 11: C. Callegari, S. Vaton, and M. Pagano, "A new statistical approach to network anomaly detection," in Proc. of the International Symposium on Performance Evaluation of Computer and Telecommunication Systems (SPECTS), 2008.

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.0 General
          Subjects: Security and protection (e.g., firewalls)

General Terms:
Algorithms, Security

Keywords:
anomaly detection, co-occurrence matrices