Abnormality metrics to detect and protect against network attacks
Guangzhi Qu, Salim Hariri, S. Jangiti, Shahid Hussain, Seungchan Oh, Samer Fayssal, M. Yousif · 2004
Internet has been growing at an amazing rate and it becomes pervasive in all aspects of our life On the other hand, the ubiquity of networked computers and their services has signijicantly increased their vulnerability to virus and worm attacks. To make pei-vasive systems and their services reliable and secure it becomes highly essential to develop on-line monitoring, analysis, and quantijication of the operational state of such systems and services under a wide range of normal and abnormal workload scenarios. In this paper, we prevent several abnormality metrics that can be used to detect abnormal behaviors and ulso can be used to quanti & the impact of attacks on pervasive system services. Our online monitoring approach is based on deploying software agents on selected routers, clients and servers to continuously monitor the measurement attributes and compute the abnormality metrics. Further, we use this metrics to quanti & the impact of attacks on the individual components and on the system as a whole. This analysis leads to identi & the most critical components in the system. We have built a test bed to experiment and evaluate the effectiveness of these metrics to detect several well-known network attacks such as MS SQL slammer worm attack, Denial of Service attack, and email worm spam. 1.