Symmetry Degree Measurement and its Applications to Anomaly Detection

Anomaly detection is an important technique used to identify patterns of unusual network behavior and keep the network under control. Today, network attacks are increasing in terms of both their number and sophistication. To avoid causing significant traffic patterns and being detected by existing techniques, many new attacks tend to involve gradual adjustment of behaviors, which always generate incomplete sessions due to their running mechanisms. Accordingly, in this work, we employ the behavior symmetry degree to profile the anomalies and further identify unusual behaviors. We first proposed a symmetry degree to identify the incomplete sessions generated by unusual behaviors; we then employ a sketch to calculate the symmetry degree of internal hosts to improve the identification efficiency for online applications. To reduce the memory cost and probability of collision, we divide the IP addresses into four segments that can be used as keys of the hash functions in the sketch. Moreover, to further improve detection accuracy, a threshold selection method is proposed for dynamic traffic pattern analysis. The hash functions in the sketch are then designed using Chinese remainder theory, which can analytically trace the IP addresses associated with the anomalies. We tested the proposed techniques based on traffic data collected from the northwest center of CERNET (China Education and Research Network); the results show that the proposed methods can effectively detect anomalies in large-scale networks.

异常检测是一种用于识别异常网络行为模式并控制网络的重要技术。如今，网络攻击在数量和复杂程度上都在增加。为了避免产生明显的流量模式并被现有技术检测到，许多新型攻击往往涉及行为的逐步调整，由于其运行机制，这些攻击总是会产生不完整的会话。因此，在这项工作中，我们利用行为对称度来描述异常情况，并进一步识别异常行为。我们首先提出一种对称度来识别由异常行为产生的不完整会话；然后我们使用一种草图来计算内部主机的对称度，以提高在线应用的识别效率。为了降低内存成本和冲突概率，我们将IP地址划分为四个段，这些段可用作草图中哈希函数的键。此外，为了进一步提高检测准确性，针对动态流量模式分析提出了一种阈值选择方法。然后利用中国剩余定理设计草图中的哈希函数，该函数能够解析地追踪与异常相关的IP地址。我们基于从中国教育和科研计算机网（CERNET）西北中心收集的流量数据对所提出的技术进行了测试；结果表明，所提出的方法能够有效地检测大规模网络中的异常。