Tuyển tập báo cáo các nghiên cứu khoa học quốc tế ngành hóa học dành cho các bạn yêu hóa học tham khảo đề tài: Research Article Network Anomaly Detection Based on Wavelet Analysis | Hindawi Publishing Corporation EURASIP Journal on Advances in Signal Processing Volume 2009 Article ID 837601 16 pages doi 2009 837601 Research Article Network Anomaly Detection Based on Wavelet Analysis Wei Lu and Ali A. Ghorbani Information Security Center of Excellence The University of New Brunswick Fredericton NB Canada E3B 5A3 Correspondence should be addressed to Wei Lu wlu@ Received 1 September 2007 Revised 3 April 2008 Accepted 2 June 2008 Recommended by Chin-Tser Huang Signal processing techniques have been applied recently for analyzing and detecting network anomalies due to their potential to find novel or unknown intrusions. In this paper we propose a new network signal modelling technique for detecting network anomalies combining the wavelet approximation and system identification theory. In order to characterize network traffic behaviors we present fifteen features and use them as the input signals in our system. We then evaluate our approach with the 1999 DARPA intrusion detection dataset and conduct a comprehensive analysis of the intrusions in the dataset. Evaluation results show that the approach achieves high-detection rates in terms of both attack instances and attack types. Furthermore we conduct a full day s evaluation in a real large-scale WiFi ISP network where five attack types are successfully detected from over 30 millions flows. Copyright 2009 W. Lu and A. A. Ghorbani. This is an open access article distributed under the Creative Commons Attribution License which permits unrestricted use distribution and reproduction in any medium provided the original work is properly cited. 1. Introduction Intrusion detection has been extensively studied since the seminal report written by Anderson 1 . Traditionally intrusion detection techniques are classified into two categories misuse detection and anomaly detection. Misuse detection is based on the assumption that most attacks leave a set of signatures in the stream of network .
