Design and Implementation of an Anomaly Detection System: an Empirical Approach
Luca Deri, Stefano Suin, Gaia Maselli · 2003
Network management platforms provide flexible facilities for setting up custom applications able to detect network anomalies on a specific environment. This is because each network is made of users, services and computers with a specific behaviour that is then reflected in the generated network traffic. The goal of this paper is to show that in every network there are some global variables that can be profitably used for detecting network anomalies regardless of the type of network users and equipment. As most of the relations among these variables are fixed, this paper shows that it is possible to define generic network rules aimed to automatically detect network anomalies. Finally, it covers the design and implementation of an application used to validate this work that is freely available on the Internet.