Name
Title | ||
|---|---|---|
A Flow-based Entropy Characterization of a NATed Network and its Application on Intrusion Detection |
Abstract | ||
|---|---|---|
This paper presents a flow-based entropy characterization of a small/medium-sized campus network that uses network address translation (NAT). Although most networks follow this configuration, their entropy characterization has not been previously studied. Measurements from a production network show that the entropies of flow elements (external IP address, external port, campus IP address, campus port) and tuples have particular characteristics. Findings include: i) entropies may widely vary in the course of a day. For example, in a typical weekday, the entropies of the campus and external ports may vary from below 0.2 to above 0.8 (in a normalized entropy scale 0-1). A similar observation applies to the entropy of the campus IP address; ii) building a granular entropy characterization of the individual flow elements can help detect anomalies. Data shows that certain attacks produce entropies that deviate from the expected patterns; iii) the entropy of the 3-tuple {external IP, campus IP, campus port} is high and consistent over time, resembling the entropy of a uniform distribution's variable. A deviation from this pattern is an encouraging anomaly indicator; iv) strong negative and positive correlations exist between some entropy time-series of flow elements. |
Year | DOI | Venue |
|---|---|---|
2019 | 10.1109/ICC.2019.8761747 | IEEE International Conference on Communications |
Keywords | Field | DocType |
Network flows,entropy,network address translation,NetFlow | Port (computer networking),Nat,Normalization (statistics),Computer science,Tuple,Campus network,Network address translation,Uniform distribution (continuous),Computer network,Intrusion detection system | Conference |
ISSN | Citations | PageRank |
1550-3607 | 0 | 0.34 |
References | Authors | |
0 | 9 | |
Name | Order | Citations | PageRank |
|---|---|---|---|
| Jorge Crichigno | 1 | 168 | 14.41 |
| E. Kfoury | 2 | 0 | 0.34 |
| Elias Bou-Harb | 3 | 207 | 26.40 |
| N. Ghani | 4 | 8 | 2.25 |
| Yasmany Prieto | 5 | 0 | 1.69 |
| Christian Vega | 6 | 0 | 0.34 |
| Jorge E. Pezoa | 7 | 119 | 15.76 |
| C. Huang | 8 | 0 | 0.34 |
| David Torres | 9 | 0 | 0.34 |