Network anomaly detection model of optimizing session attributes
Xiaoli Ma · Jisuanji gongcheng yu sheji · 2005
The detection performance of network anomaly detectionmodel depends on network session attributes to a great extentbecause session attributes characterize network behavior profile.Tcpdump network traffic packets were regarded as the experiment data set.Traffic packets were resolved into session records with basic attributes.A concise and exact combination pattern for session attributes is proposed based on what-if experiment analysis.The experiment results indicate that the optimized pattern for session attributes improves the detection performance of anomaly detection model against unknown attacks.Better detection effects are not achieved by training de-tection model with basic,full and arbitrary attributes.