Paper Info
Title
Integrating Traffics with Network Device Logs for Anomaly Detection.
Abstract
Advanced cyberattacks are often featured by multiple types, layers, and stages, with the goal of cheating the monitors. Existing anomaly detection systems usually search logs or traffics alone for evidence of attacks but ignore further analysis about attack processes. For instance, the traffic detection methods can only detect the attack flows roughly but fail to reconstruct the attack event process and reveal the current network node status. As a result, they cannot fully model the complex multistage attack. To address these problems, we present Traffic-Log Combined Detection (TLCD), which is a multistage intrusion analysis system. Inspired by multiplatform intrusion detection techniques, we integrate traffics with network device logs through association rules. TLCD correlates log data with traffic characteristics to reflect the attack process and construct a federated detection platform. Specifically, TLCD can discover the process steps of a cyberattack attack, reflect the current network status, and reveal the behaviors of normal users. Our experimental results over different cyberattacks demonstrate that TLCD works well with high accuracy and low false positive rate.
Year
DOI
Venue
2019
10.1155/2019/5695021
SECURITY AND COMMUNICATION NETWORKS
Field
DocType
Volume
False positive rate,Anomaly detection,Intrusion,Computer science,Networking hardware,Node (networking),Computer network,Association rule learning,Cheating,Intrusion detection system
Journal
2019
ISSN
Citations 
PageRank 
1939-0114
0
0.34
References 
Authors
0
7
Name
Order
Citations
PageRank
Jiazhong Lu142.81
Fengmao Lv2273.49
Zhongliu Zhuo332.09
Xiaosong Zhang49114.00
Xiaolei Liu5118.70
Teng Hu672.85
Wei Deng713517.45