An improvement of the state-of-the-art covariance-based methods for statistical anomaly detection algorithms

被引：18

作者：

Fortunati, Stefano ^{[1
]}

Gini, Fulvio ^{[1
]}

Greco, Maria S. ^{[1
]}

Farina, Alfonso ^{[3
]}

Graziano, Antonio ^{[2
]}

Giompapa, Sofia ^{[2
]}

机构：

[1] Univ Pisa, Dipartimento Ingn Informaz, Pisa, Italy

[2] Selex ES, Rome, Italy

[3] IEEE AESS BoG VP Ind Relat, Rome, Italy

来源：

SIGNAL IMAGE AND VIDEO PROCESSING | 2016年 / 10卷 / 04期

关键词：

Intrusion detection system; Statistical anomaly detection; Covariance matrix; Flooding attacks;

D O I：

10.1007/s11760-015-0796-y

中图分类号：

TM [电工技术]; TN [电子技术、通信技术];

学科分类号：

0808 ; 0809 ;

摘要：

This paper presents a possible improvement to one of the main statistical anomaly detection algorithms for cyber security applications, i.e., the covariance-based method. This algorithm employs covariance matrices to build a norm profile of the normal network traffic and to detect anomalous activities in the data flow. In order to improve the detection capabilities of this algorithm, we propose a modified version of the statistical decision rule based on a generalized version of the Chebyshev inequality for random vectors. The performance of the proposed algorithm is evaluated and compared, in terms of ROC (receiver operating characteristic) curves with the ones of the state-of-the-art covariance-based algorithm.

引用

页码：687 / 694

页数：8