Intrusion detection using geometrical structure

Publication Type:
Conference Proceeding
Citation:
4th International Conference on Frontier of Computer Science and Technology, FCST 2009, 2009, pp. 327 - 333
Issue Date:
2009-12-01
Metrics:
Full metadata record
Files in This Item:
Filename Description Size
Thumbnail2009001735OK.pdf279.34 kB
Adobe PDF
We propose a statistical model, namely Geometrical Structure Anomaly Detection (GSAD) to detect intrusion using the packet payload in the network. GSAD takes into account the correlations among the packet payload features arranged in a geometrical structure. The representation is based on statistical analysis of Mahalanobis distances among payload features, which calculate the similarity of new data against precomputed profile. It calculates weight factor to determine anomaly in the payload. In the 1999 DARPA intrusion detection evaluation data set, we conduct several tests for limited attacks on port 80 and port 25. Our approach establishes and identifies the correlation among packet payloads in a network. © 2009 IEEE.
Please use this identifier to cite or link to this item: