Host Activity Analysis Using Correlation Approach For Anomaly Activity Detection
Dandy Pramana Hostiadi, Yohanes Priyo Atmojo, Florentina Tatrin Kurniati · 2019
Anomaly activity can indicate behavior activity on the computer network. The development of anomaly activity detection model has been proposed by previous researchers, known as correlation. However, that model depends on the quality, accuracy, heterogeneous, and type of alerts produced. In this research, a new model was proposed to detect anomaly activity with a correlation approach. This method is used as the basis for anomaly activity detection process and measures the correlation strength between hosts activities in the network, obtained from the process of recording network activities and does not require alert information from the IDS system. Each activity is measured according to the group of source host that sort by the information of time and frequency. From the results of each activity correlation, it was remeasurement to get anomaly activity categories by determining the level of activity intensity at the time of observation. The results showed that the proposed model could detect 86.67% of the anomaly activities of 458 pairwise activities that are correlated.