Detecting anomalous network hosts by means of PCA

摘要: This paper focuses on the identification of anomalous hosts within a computer network with motivation to detect attacks and/or other unwanted and suspicious traffic. The proposed detection method does not use content packets, which enables be used encrypted networks. Moreover, has very low computational complexity allowing fast response important for limitation potential damages. uses entropies IP addresses ports build two complementary models host's traffic based principal component analysis. These are coupled orthogonal anomaly definitions, gives four different detectors. methods evaluated compared prior art one week long capture university network. experiments reveals that no single detector can all types anomalies, is expected stresses importance ensemble approach towards intrusion detection.