DIAMoND: Distributed Intrusion/Anomaly Monitoring for Nonparametric Detection
DIAMoND: Distributed Intrusion/Anomaly Monitoring for Nonparametric Detection
复制标题
DIAMoND：用于非参数检测的分布式入侵/异常监控
DOI：
--
复制
发表时间：
2015
期刊：
影响因子：
--
通讯作者：
N. Fefferman
中科院分区：
文献类型：
--
作者：
Maciej Korczyński;Ali Hamieh;Jun Ho Huh;Henrik Holm;S. Raj Rajagopalan;N. Fefferman
本文描述了一种用于网络入侵/异常检测的完全非参数、可伸缩的分布式检测算法。我们将讨论这种方法如何应对日益增长的分布式攻击趋势，同时也为分布式检测系统中常见的问题提供解决方案。从网络拓扑结构、为每个节点定义的分布式通信范围以及在分布式检测通信中只涉及网络中总节点的一小部分对检测性能的影响进行了探讨。我们使用基于软件的测试实现对我们的算法进行了评估，并展示了对于隐蔽端口扫描和DDoS攻击的并行隔离异常检测器的检测能力提高了高达20%。
In this paper, we describe a fully nonparametric, scalable, distributed detection algorithm for intrusion/anomaly detection in networks. We discuss how this approach addresses a growing trend in distributed attacks while also providing solutions to problems commonly associated with distributed detection systems. We explore the impacts to detection performance from network topology, from the defined range of distributed communication for each node, and from involving only a small percent of total nodes in the network in the distributed detection communication. We evaluate our algorithm using a software-based testing implementation, and demonstrate up to 20% improvement in detection capability over parallel, isolated anomaly detectors for both stealthy port scans and DDoS attacks.