Performance evaluation of a multi-stage network event detection scheme for decreasing the false-positive rate for a large number of simultaneous, unknown events

Tutomu Murase, Hiroki Fujiwara, Yukinobu Fukushima, Masayoshi Kobayashi, Tokumi Yokohira

Research output: Chapter in Book/Report/Conference proceedingConference contribution

1 Citation (Scopus)

Abstract

Change-point detection schemes are a promising approach for detecting network anomalies, such as attacks and epidemics by unknown viruses and worms. They detect those events as change-points. However, they generally also detect false-positive change-points, those caused by other events such as hardware trouble. A scheme is needed that only detects truepositive change-points, caused by attacks and epidemics. Truepositive change-points tend to occur simultaneously in very large numbers, while false-positive change-points tend to occur sporadically. We can exclude false-positive change-points by excluding change-points that occur sporadically, based on information gathered from the entire network. In this paper, we propose a multi-stage network event detection scheme that aggregates change-point information from distributed IDSs (Intrusion Detection Systems) and detects the true-positive change-points. Simulation results show that, compared to a scheme using only one IDS, our method always yields a smaller false-positive rate under the constraint that the detection rate of the true-positive change-points must exceed 0.99.

Original languageEnglish
Title of host publicationProceedings of the Sixth International Conference on Networking, ICN'07
DOIs
Publication statusPublished - Oct 11 2007
Event6th International Conference on Networking, ICN'07 - Sainte-Luce, Martinique, France
Duration: Apr 22 2007Apr 28 2007

Publication series

NameProceedings of the Sixth International Conference on Networking, ICN'07

Other

Other6th International Conference on Networking, ICN'07
CountryFrance
CitySainte-Luce, Martinique
Period4/22/074/28/07

Keywords

  • Change-point detection
  • Large-sccde simultaneous event
  • Multi-stage network anomaly detection
  • Virus
  • Worm

ASJC Scopus subject areas

  • Computer Networks and Communications
  • Control and Systems Engineering

Fingerprint Dive into the research topics of 'Performance evaluation of a multi-stage network event detection scheme for decreasing the false-positive rate for a large number of simultaneous, unknown events'. Together they form a unique fingerprint.

  • Cite this

    Murase, T., Fujiwara, H., Fukushima, Y., Kobayashi, M., & Yokohira, T. (2007). Performance evaluation of a multi-stage network event detection scheme for decreasing the false-positive rate for a large number of simultaneous, unknown events. In Proceedings of the Sixth International Conference on Networking, ICN'07 [4196290] (Proceedings of the Sixth International Conference on Networking, ICN'07). https://doi.org/10.1109/ICN.2007.71