A Novel Hybrid Method for Network Anomaly Detection Based on Traffic Prediction and Change Point Detection

TL;DR

This paper introduces a new hybrid method combining traffic prediction and change point detection to identify DDoS attacks in networks, achieving high accuracy and perfect sensitivity.

Contribution

It presents the first integration of traffic prediction with change point detection for network anomaly detection, specifically targeting DDoS attacks.

Findings

Accuracy of 98.3% in attack detection

Sensitivity of 100%, detecting all attacks

Effective prevention of network threats

Abstract

In recent years, computer networks have become more and more advanced in terms of size, applications, complexity and level of heterogeneity. Moreover, availability and performance are important issues for end users. New types of cyber-attacks that can affect and damage network performance and availability are constantly emerging and some threats, such as Distributed Denial of Service (DDoS) attacks, can be very dangerous and cannot be easily prevented. In this study, we present a novel hybrid approach to detecting a DDoS attack by means of monitoring abnormal traffic in the network. This approach reads traffic data and from that it is possible to build a model, by means of which future data may be predicted and compared with observed data, in order to detect any abnormal traffic. This approach combines two methods: traffic prediction and changing detection. To the best of our knowledge, such a combination has never been used in this area before. The approach achieved a highly significant accuracy rate of 98.3% and sensitivity was 100%, which means that all potential attacks are detected and prevented from penetrating the network system.