ARIMA based network anomaly detection

Asrul H. Yaacob; Ian K. T. Tan; Su Fong Chien; Hon Khi Tan

doi:10.1109/ICCSN.2010.55

ARIMA based network anomaly detection

Asrul H. Yaacob, Ian K. T. Tan, Su Fong Chien, Hon Khi Tan

School of Mathematical & Computer Sciences

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

133 Citations (Scopus)

Abstract

An early warning system on potential attacks from networks will enable network administrators or even automated network management software to take preventive measures. This is needed as we move towards maximizing the utilization of the network with new paradigms such as Web Services and Software As A Service. This paper introduces a novel approach through using Auto-Regressive Integrated Moving Average (ARIMA) technique to detect potential attacks that may occur in the network. The solution is able to provide feedback through its predictive capabilities and hence provide an early warning system. With the affirmative results, this technique can serve beyond the detection of Denial of Service (DoS) and with sufficient development; an automated defensive solution can be achieved.

Original language	English
Title of host publication	2nd International Conference on Communication Software and Networks 2010
Publisher	IEEE
Pages	205-209
Number of pages	5
ISBN (Electronic)	9781424457274
DOIs	https://doi.org/10.1109/ICCSN.2010.55
Publication status	Published - 25 Mar 2010
Event	2nd International Conference on Communication Software and Networks 2010 - Singapore, Singapore Duration: 26 Feb 2010 → 28 Feb 2010

Conference

Conference	2nd International Conference on Communication Software and Networks 2010
Abbreviated title	ICCSN 2010
Country/Territory	Singapore
City	Singapore
Period	26/02/10 → 28/02/10

Keywords

ARIMA
Denial of service
Forecasting
Intrusion detection
Network security

ASJC Scopus subject areas

Computer Networks and Communications
Software

Access to Document

10.1109/ICCSN.2010.55

Cite this

@inproceedings{2ddeaf3ec55044669bebc5a31fbf68bb,

title = "ARIMA based network anomaly detection",

abstract = "An early warning system on potential attacks from networks will enable network administrators or even automated network management software to take preventive measures. This is needed as we move towards maximizing the utilization of the network with new paradigms such as Web Services and Software As A Service. This paper introduces a novel approach through using Auto-Regressive Integrated Moving Average (ARIMA) technique to detect potential attacks that may occur in the network. The solution is able to provide feedback through its predictive capabilities and hence provide an early warning system. With the affirmative results, this technique can serve beyond the detection of Denial of Service (DoS) and with sufficient development; an automated defensive solution can be achieved.",

keywords = "ARIMA, Denial of service, Forecasting, Intrusion detection, Network security",

author = "Yaacob, {Asrul H.} and Tan, {Ian K. T.} and Chien, {Su Fong} and Tan, {Hon Khi}",

year = "2010",

month = mar,

day = "25",

doi = "10.1109/ICCSN.2010.55",

language = "English",

pages = "205--209",

booktitle = "2nd International Conference on Communication Software and Networks 2010",

publisher = "IEEE",

address = "United States",

note = "2nd International Conference on Communication Software and Networks 2010, ICCSN 2010 ; Conference date: 26-02-2010 Through 28-02-2010",

}

TY - GEN

T1 - ARIMA based network anomaly detection

AU - Yaacob, Asrul H.

AU - Tan, Ian K. T.

AU - Chien, Su Fong

AU - Tan, Hon Khi

PY - 2010/3/25

Y1 - 2010/3/25

N2 - An early warning system on potential attacks from networks will enable network administrators or even automated network management software to take preventive measures. This is needed as we move towards maximizing the utilization of the network with new paradigms such as Web Services and Software As A Service. This paper introduces a novel approach through using Auto-Regressive Integrated Moving Average (ARIMA) technique to detect potential attacks that may occur in the network. The solution is able to provide feedback through its predictive capabilities and hence provide an early warning system. With the affirmative results, this technique can serve beyond the detection of Denial of Service (DoS) and with sufficient development; an automated defensive solution can be achieved.

AB - An early warning system on potential attacks from networks will enable network administrators or even automated network management software to take preventive measures. This is needed as we move towards maximizing the utilization of the network with new paradigms such as Web Services and Software As A Service. This paper introduces a novel approach through using Auto-Regressive Integrated Moving Average (ARIMA) technique to detect potential attacks that may occur in the network. The solution is able to provide feedback through its predictive capabilities and hence provide an early warning system. With the affirmative results, this technique can serve beyond the detection of Denial of Service (DoS) and with sufficient development; an automated defensive solution can be achieved.

KW - ARIMA

KW - Denial of service

KW - Forecasting

KW - Intrusion detection

KW - Network security

UR - http://www.scopus.com/inward/record.url?scp=77952362091&partnerID=8YFLogxK

U2 - 10.1109/ICCSN.2010.55

DO - 10.1109/ICCSN.2010.55

M3 - Conference contribution

AN - SCOPUS:77952362091

SP - 205

EP - 209

BT - 2nd International Conference on Communication Software and Networks 2010

PB - IEEE

T2 - 2nd International Conference on Communication Software and Networks 2010

Y2 - 26 February 2010 through 28 February 2010

ER -

ARIMA based network anomaly detection

Abstract

Conference

Keywords

ASJC Scopus subject areas

Access to Document

Other files and links

Fingerprint

Cite this