Performance evaluation of a multi-stage network event detection scheme for decreasing the false-positive rate for a large number of simultaneous, unknown events

Tutomu Murase, Hiroki Fujiwara, Yukinobu Fukushima, Masayoshi Kobayashi, Tokumi Yokohira

Research output: Chapter in Book/Report/Conference proceedingConference contribution

1 Citation (Scopus)

Abstract

Change-point detection schemes are a promising approach for detecting network anomalies, such as attacks and epidemics by unknown viruses and worms. They detect those events as change-points. However, they generally also detect false-positive change-points, those caused by other events such as hardware trouble. A scheme is needed that only detects truepositive change-points, caused by attacks and epidemics. Truepositive change-points tend to occur simultaneously in very large numbers, while false-positive change-points tend to occur sporadically. We can exclude false-positive change-points by excluding change-points that occur sporadically, based on information gathered from the entire network. In this paper, we propose a multi-stage network event detection scheme that aggregates change-point information from distributed IDSs (Intrusion Detection Systems) and detects the true-positive change-points. Simulation results show that, compared to a scheme using only one IDS, our method always yields a smaller false-positive rate under the constraint that the detection rate of the true-positive change-points must exceed 0.99.

Original languageEnglish
Title of host publicationProceedings of the Sixth International Conference on Networking, ICN'07
DOIs
Publication statusPublished - 2007
Event6th International Conference on Networking, ICN'07 - Sainte-Luce, Martinique, France
Duration: Apr 22 2007Apr 28 2007

Other

Other6th International Conference on Networking, ICN'07
CountryFrance
CitySainte-Luce, Martinique
Period4/22/074/28/07

Fingerprint

Intrusion detection
Viruses
Hardware

Keywords

  • Change-point detection
  • Large-sccde simultaneous event
  • Multi-stage network anomaly detection
  • Virus
  • Worm

ASJC Scopus subject areas

  • Computer Networks and Communications
  • Control and Systems Engineering

Cite this

Performance evaluation of a multi-stage network event detection scheme for decreasing the false-positive rate for a large number of simultaneous, unknown events. / Murase, Tutomu; Fujiwara, Hiroki; Fukushima, Yukinobu; Kobayashi, Masayoshi; Yokohira, Tokumi.

Proceedings of the Sixth International Conference on Networking, ICN'07. 2007. 4196290.

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Murase, T, Fujiwara, H, Fukushima, Y, Kobayashi, M & Yokohira, T 2007, Performance evaluation of a multi-stage network event detection scheme for decreasing the false-positive rate for a large number of simultaneous, unknown events. in Proceedings of the Sixth International Conference on Networking, ICN'07., 4196290, 6th International Conference on Networking, ICN'07, Sainte-Luce, Martinique, France, 4/22/07. https://doi.org/10.1109/ICN.2007.71
Murase, Tutomu ; Fujiwara, Hiroki ; Fukushima, Yukinobu ; Kobayashi, Masayoshi ; Yokohira, Tokumi. / Performance evaluation of a multi-stage network event detection scheme for decreasing the false-positive rate for a large number of simultaneous, unknown events. Proceedings of the Sixth International Conference on Networking, ICN'07. 2007.
@inproceedings{757cb4e053024f548c41b27c647dc6e8,
title = "Performance evaluation of a multi-stage network event detection scheme for decreasing the false-positive rate for a large number of simultaneous, unknown events",
abstract = "Change-point detection schemes are a promising approach for detecting network anomalies, such as attacks and epidemics by unknown viruses and worms. They detect those events as change-points. However, they generally also detect false-positive change-points, those caused by other events such as hardware trouble. A scheme is needed that only detects truepositive change-points, caused by attacks and epidemics. Truepositive change-points tend to occur simultaneously in very large numbers, while false-positive change-points tend to occur sporadically. We can exclude false-positive change-points by excluding change-points that occur sporadically, based on information gathered from the entire network. In this paper, we propose a multi-stage network event detection scheme that aggregates change-point information from distributed IDSs (Intrusion Detection Systems) and detects the true-positive change-points. Simulation results show that, compared to a scheme using only one IDS, our method always yields a smaller false-positive rate under the constraint that the detection rate of the true-positive change-points must exceed 0.99.",
keywords = "Change-point detection, Large-sccde simultaneous event, Multi-stage network anomaly detection, Virus, Worm",
author = "Tutomu Murase and Hiroki Fujiwara and Yukinobu Fukushima and Masayoshi Kobayashi and Tokumi Yokohira",
year = "2007",
doi = "10.1109/ICN.2007.71",
language = "English",
isbn = "0769528058",
booktitle = "Proceedings of the Sixth International Conference on Networking, ICN'07",

}

TY - GEN

T1 - Performance evaluation of a multi-stage network event detection scheme for decreasing the false-positive rate for a large number of simultaneous, unknown events

AU - Murase, Tutomu

AU - Fujiwara, Hiroki

AU - Fukushima, Yukinobu

AU - Kobayashi, Masayoshi

AU - Yokohira, Tokumi

PY - 2007

Y1 - 2007

N2 - Change-point detection schemes are a promising approach for detecting network anomalies, such as attacks and epidemics by unknown viruses and worms. They detect those events as change-points. However, they generally also detect false-positive change-points, those caused by other events such as hardware trouble. A scheme is needed that only detects truepositive change-points, caused by attacks and epidemics. Truepositive change-points tend to occur simultaneously in very large numbers, while false-positive change-points tend to occur sporadically. We can exclude false-positive change-points by excluding change-points that occur sporadically, based on information gathered from the entire network. In this paper, we propose a multi-stage network event detection scheme that aggregates change-point information from distributed IDSs (Intrusion Detection Systems) and detects the true-positive change-points. Simulation results show that, compared to a scheme using only one IDS, our method always yields a smaller false-positive rate under the constraint that the detection rate of the true-positive change-points must exceed 0.99.

AB - Change-point detection schemes are a promising approach for detecting network anomalies, such as attacks and epidemics by unknown viruses and worms. They detect those events as change-points. However, they generally also detect false-positive change-points, those caused by other events such as hardware trouble. A scheme is needed that only detects truepositive change-points, caused by attacks and epidemics. Truepositive change-points tend to occur simultaneously in very large numbers, while false-positive change-points tend to occur sporadically. We can exclude false-positive change-points by excluding change-points that occur sporadically, based on information gathered from the entire network. In this paper, we propose a multi-stage network event detection scheme that aggregates change-point information from distributed IDSs (Intrusion Detection Systems) and detects the true-positive change-points. Simulation results show that, compared to a scheme using only one IDS, our method always yields a smaller false-positive rate under the constraint that the detection rate of the true-positive change-points must exceed 0.99.

KW - Change-point detection

KW - Large-sccde simultaneous event

KW - Multi-stage network anomaly detection

KW - Virus

KW - Worm

UR - http://www.scopus.com/inward/record.url?scp=34948813610&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=34948813610&partnerID=8YFLogxK

U2 - 10.1109/ICN.2007.71

DO - 10.1109/ICN.2007.71

M3 - Conference contribution

SN - 0769528058

SN - 9780769528052

BT - Proceedings of the Sixth International Conference on Networking, ICN'07

ER -