Mahalanobis Distance Map Approach for Anomaly Detection
Mahalanobis Distance Map Approach for Anomaly Detection
复制标题
用于异常检测的马哈拉诺比斯距离图方法
DOI：
10.4225/75/57b66f5a3477b
复制
发表时间：
2010
期刊：
影响因子：
--
通讯作者：
R. Liu
中科院分区：
文献类型：
--
作者：
Aruna Jamdagni;Aruna Jamdagni;Zhiyuan Tan;P. Nanda;Xiangjian He;R. Liu
Web服务器和基于Web的应用程序通常用作攻击目标。主要问题是如何防止未经授权的访问并保护Web服务器免受攻击。入侵检测系统（IDS）是广泛使用的安全工具，可检测计算机系统和网络中的网络攻击和恶意活动。在本文中，我们专注于使用几何结构异常检测（GSAD）模型检测各种基于Web的攻击，并且还提出了一种新型算法，以选择最歧视的特征，以提高基于有效载荷的GSAD模型的计算复杂性。线性判别方法（LDA）用于降低和分类网络流量。 GSAD模型基于图像处理中使用的模式识别技术。它分析了各种有效载荷特征之间的相关性，并使用Mahalanobis距离图（MDM）来计算正常网络流量和异常网络流量之间的差异。我们专注于检测通用攻击，外壳代码攻击，多态性攻击和多态性混合攻击。我们对GEORGIA理工学院创建的现实攻击数据集进行了实验评估GSAD模型的准确性。我们在DARPA 99数据集上进行了初步实验，以评估功能降低的准确性。
Web servers and web-based applications are commonly used as attack targets. The main issues are how to prevent unauthorised access and to protect web servers from the attack. Intrusion Detection Systems (IDSs) are widely used security tools to detect cyber-attacks and malicious activities in computer systems and networks. In this paper, we focus on the detection of various web-based attacks using Geometrical Structure Anomaly Detection (GSAD) model and we also propose a novel algorithm for the selection of most discriminating features to improve the computational complexity of payload-based GSAD model. Linear Discriminant method (LDA) is used for the feature reduction and classification of the incoming network traffic. GSAD model is based on a pattern recognition technique used in image processing. It analyses the correlations between various payload features and uses Mahalanobis Distance Map (MDM) to calculate the difference between normal and abnormal network traffic. We focus on the detection of generic attacks, shell code attacks, polymorphic attacks and polymorphic blending attacks. We evaluate accuracy of GSAD model experimentally on the real-world attacks dataset created at Georgia Institute of Technology. We conducted preliminary experiments on the DARPA 99 dataset to evaluate the accuracy of feature reduction.