CUSUM-based and entropy-based network anomaly detection: An experimental comparison
Christian Callegari, Michele Pagano, Stefano Giordano, F. Berizzi · 2017
The impressive growth of the Internet and the ever increasing number of sensitive services together with the unawareness of the risks deriving from information sharing on the net by a significant amount of end-users pose serious security concerns. In such a scenario, Network Anomaly detection, due to its ability to face unknown attacks and new security threats, has attracted many research efforts in the last decade and, as such, a lot of different methods and approaches have been proposed. In this paper we present an extensive performance comparison between two of the most promising anomaly detection methods (namely CUSUM-based and Entropy-based), when applied to real backbone network traffic traces. The experimental results demonstrate that the effectiveness of the considered methods are strongly influenced by the considered traffic descriptors.