Algorithms for network server anomaly behavior detection without traffic content inspection
Vladimir L. Eliseev, Anastasiya Gurina · 2016
A problem of anomaly behavior detection for network server without traffic inspection is discussed. An importance of the problem is proved in a context of broad use of typical communication engines in servers and Internet of Things. A cross-correlation function for request-response characterization is introduced. An applicability of this approach was probed on SSH, DNS, HTTP and HTTPS real traffic. Two algorithms are provided to work with cross-correlation functions: one is based on Pearson correlation coefficient and another based on neural network one class classifier. Traffic of real HTTP and HTTPS servers is used to investigate algorithms and analyze their results. Key features and important parameters of both algorithms are highlighted. Not typical request-response events detection is demonstrated on test traffic series. Actuality and lightweight quality of the approach are emphasized regarding intrusion detection system implementation for typical servers, M2M and IoT applications.