Anomaly detection using Source Port Data with Shannon Entropy and EWMA Control Chart
S. Ransewa, Nittida Elz, Nithi Thanon, Sathit Intajag · International Conference on Control, Automation and Systems · 2018
This paper presents a network intrusion detection system using packet distributions of source port data. Shannon entropy was used to encode the data. The encoded data were employed to estimate detection parameters, which are approximated by an exponentially weighted moving average (EWMA) control chart. In the experimentation, we have determined the sizes of group that can provide accurate detection.