Statistical Anomaly Detection on Real e-Mail Traffic

摘要: There are many recent studies and proposal in Anomaly Detection Techniques, especially worm virus detection. In this field it does matter to answer few important questions like at which ISO/OSI layer data analysis is done approach used. Furthermore these works suffer of scarcity real due lack network resources or privacy problem: almost every work sector uses synthetic (e.g. DARPA) pre-made set data. Our study based on seven quantities (number e-mail sent a chosen period): we analyzed quantitatively our traffic (4 SMTP servers, 10 class C networks) applied method gathered detect indirect infection (worms use spread infection). The threshold and, dataset, identified various activities. document show results order stimulate new approaches debates Intrusion Techniques.