Study on Histogram Database for DetectingNetwork Attacks

点击翻译按钮获取中文摘要

By this study, it was made clear that the network attacks can be detected by checking the characteristic features of the packet traffics. As a concrete approach, we proposed a novel approach based on normal behavior mode for fast detection of distributed port scans in darknets. In this approach, the number of sources is counted in each time unit and a histogram is built for each of the monitored ports. Then, a normal behavior mode for each port can be extracted from the histogram of this port. At last, this normal behaviormode can be used to detectabnormal behaviors in the real network traffics. The related papers havebeen accepted by an internal conference and the Journal of Information Processing of IPJS.