DiNATrAX : a Network Anomalies Detection Framework - Archive ouverte HAL
Communication Dans Un Congrès Année : 2024

DiNATrAX : a Network Anomalies Detection Framework

Résumé

Network anomaly detection remains an important research topic in the field of cybersecurity. A network anomaly can be defined as an activity or event that does not correspond to an expected or established traffic behavior. This includes traffic due to cybersecurity attacks (intrusions, malware, DDoS, phishing, etc.), technical failures, or operational errors. Distinguishing between normal and abnormal traffic is essential. Normal traffic is usually defined by a statistical baseline or an expected behavior model, while abnormal traffic deviates from this norm. To detect these anomalies, we propose our framework named DiNATrAX . It is a generic, cyclical, adaptable, and automatable methodology based on the use of different unsupervised machine learning algorithms. DiNATrAX is organized into 3 functional blocks. The first block aims to collect and pre-process raw network data. The second block allows for the splitting of the network in order to define logical sectors for analysis. For each of these, a digital signature is generated at regular intervals. These signatures constitute our baseline for comparing network flows. Then, for each of these signatures, we calculate its DNA which allows us to automate the comparison of different signatures. This comparison is performed by the third block which calculates the abnormality distance between 2 consecutive DNAs. If a high abnormality distance is detected, it highlights a variation in network activity and therefore an anomaly which may be correlated with a particular event.Our solution allows us to highligt seven real anomalies correlated to real events from two particular sectors.
Fichier principal
Vignette du fichier
dinatrax.pdf (4.32 Mo) Télécharger le fichier
Origine Fichiers produits par l'(les) auteur(s)
Licence

Dates et versions

hal-04697937 , version 1 (14-09-2024)

Licence

Identifiants

Citer

Christophe Maudoux, Selma Boumerdassi. DiNATrAX : a Network Anomalies Detection Framework. International Conference on Communications, IEEE, Jun 2024, Denver (CO), United States. pp.4090-4095, ⟨10.1109/ICC51166.2024.10622410⟩. ⟨hal-04697937⟩
107 Consultations
27 Téléchargements

Altmetric

Partager

More