An unsupervised approach for traffic trace sanitization based on the entropy spaces
The accuracy and reliability of an anomaly-based network intrusion detection system are dependent on the quality of data used to build a normal behavior profile. However, obtaining these datasets is not trivial due to privacy, obsolescence, and suitability issues. This paper presents an approac...
Saved in:
| Main Author: | |
|---|---|
| Format: | Artículo |
| Language: | spa |
| Published: |
Springer US
2017
|
| Subjects: | |
| Online Access: | http://hdl.handle.net/20.500.11961/3078 |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| Summary: | The accuracy and reliability of an anomaly-based
network intrusion detection system are dependent on the
quality of data used to build a normal behavior profile. However,
obtaining these datasets is not trivial due to privacy,
obsolescence, and suitability issues. This paper presents an
approach to traffic trace sanitization based on the identifi-
cation of anomalous patterns in a three-dimensional entropy
space of the flow traffic data captured from a campus network.
Anomaly-free datasets are generated by filtering out
attacks and traffic pieces that modify the typical position of
centroids in the entropy space. Our analyses were performed
on real life traffic traces and show that the sanitized datasets
have homogeneity and consistency in terms of cluster centroids
and probability distributions of the PCA-transformed
entropy space. |
|---|