A Flow-Based Entropy Characterization of a NATed Network and Its Application on Intrusion Detection

摘要: This paper presents a flow-based entropy characterization of small/medium-sized campus network that uses address translation (NAT). Although most networks follow this configuration, their has not been previously studied. Measurements from production show the entropies flow elements (external IP address, external port, port) and tuples have particular characteristics. Findings include: i) may widely vary in course day. For example, typical weekday, ports below 0.2 to above 0.8 (in normalized scale 0–1). A similar observation applies address; ii) building granular individual can help detect anomalies. Data shows certain attacks produce deviate expected patterns; iii) 3-tuple {external IP, port} is high consistent over time, resembling uniform distribution's variable. deviation pattern an encouraging anomaly indicator; iv) strong negative positive correlations exist between some time-series elements.