Univariate Distribution Differences and Conditional Variables in Multivariate Data Associations as Network Flow Measures to Detect Network Attacks

Nong Ye, Ting Yan Fok, Douglas Montgomery

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

Network flow data can be used to detect network attacks which manifest deviations from profiles of normal network flows. This paper presents several measures of network flows to detect network attacks. These network flow measures are established from an analytical study of network flow data from benign network activities and network attacks provided by Canadian Institute of Cybersecurity. Both univariate and multivariate analyses of network flow data are carried out to examine differences between benign network activities and network attacks in univariate frequency distributions and multivariate data associations of network flow variables. The univariate measure of network flows is established to detect network attacks using a measure of distribution difference and the number of network flow variables showing the distribution difference greater than a certain threshold. The multivariate measure of network flows are established to detect network attacks using the number of network flow variables smaller than a certain threshold and the absence of certain network flow variables in conditional variable values of multivariate data associations.

Original languageEnglish (US)
Title of host publicationICBDC 2021 - 2021 6th International Conference on Big Data and Computing
PublisherAssociation for Computing Machinery
Pages41-48
Number of pages8
ISBN (Electronic)9781450389808
DOIs
StatePublished - May 22 2021
Externally publishedYes
Event6th International Conference on Big Data and Computing, ICBDC 2021 - Virtual, Online, China
Duration: May 22 2021May 24 2021

Publication series

NameACM International Conference Proceeding Series

Conference

Conference6th International Conference on Big Data and Computing, ICBDC 2021
Country/TerritoryChina
CityVirtual, Online
Period5/22/215/24/21

Keywords

  • Network flow data
  • Network intrusion detection
  • Univariate and multivariate data analysis

ASJC Scopus subject areas

  • Human-Computer Interaction
  • Computer Networks and Communications
  • Computer Vision and Pattern Recognition
  • Software

Fingerprint

Dive into the research topics of 'Univariate Distribution Differences and Conditional Variables in Multivariate Data Associations as Network Flow Measures to Detect Network Attacks'. Together they form a unique fingerprint.

Cite this