Advanced methods for detecting unusual behaviors on networks in real-time
Gang Xu, Hui Zhang · 2002
This paper introduces a brand-new approach to detecting unusual behaviors on networks by real-time analysis of packet patterns. The analysis methods are based on a cross-queuing model. In the model, length of queue and threshold of repeated appearance time are key parameters to filter unusual behaviors. Practical implementation and analysis have verified that the methods can detect not only attacks on network, but also other unusual behaviors, such as unconscious wrong operations, incorrect configurations, etc. The methods provide a real-time efficient way to analyse traffic on high-speed networks and can help to increase valid usage rates of network resources.