Skip to main content

An Adaptive Approach to Granular Real-Time Anomaly Detection

Abstract

Anomaly-based intrusion detection systems have the ability to detect novel attacks, but when applied in real-time detection, they face the challenges of producing many false alarms and failing to match with the high speed of modern networks due to their computationally demanding algorithms. In this paper, we present Fates, an anomaly-based NIDS designed to alleviate the two challenges. Fates views the monitored network as a collection of individual hosts instead of as a single autonomous entity and uses dynamic, individual threshold for each monitored host, such that it can differentiate between characteristics of individual hosts and can independently assess their threat to the network. Each packet to and from a monitored host is analyzed with an adaptive and efficient charging scheme that considers the packet type, number of occurrences, source, and destination. The resulting charge is applied to the individual hosts threat assessment, providing pinpointed analysis of anomalous activities. We use various datasets to validate Fates ability to distinguish scanning behavior from benign traffic in real time.

Publisher note

To access the full article, please see PDF.

Author information

Affiliations

Authors

Corresponding author

Correspondence to Chin-Tser Huang.

Rights and permissions

Open Access This article is distributed under the terms of the Creative Commons Attribution 2.0 International License (https://creativecommons.org/licenses/by/2.0), which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

Reprints and Permissions

About this article

Cite this article

Huang, C., Janies, J. An Adaptive Approach to Granular Real-Time Anomaly Detection. EURASIP J. Adv. Signal Process. 2009, 589413 (2009). https://doi.org/10.1155/2009/589413

Download citation

Keywords

  • Intrusion Detection
  • Anomaly Detection
  • Intrusion Detection System
  • Individual Host
  • Individual Threshold