Publikationen

Autor	Garcia Cordero, Carlos; Hauke, Sascha; Mühlhäuser, Max; Fischer, Mathias
Datum	2016
Art	Conference Proceedings
Abstrakt	Defending key network infrastructure, such as Internet backbone links or the communication channels of critical infrastructure, is paramount, yet challenging. The inherently complex nature and quantity of network data impedes detecting attacks in real world settings. In this paper, we utilize features of network flows, characterized by their entropy, together with an extended version of the original Replicator Neural Network (RNN) and deep learning techniques to learn models of normality. This combination allows us to apply anomaly-based intrusion detection on arbitrarily large amounts of data and, consequently, large networks. Our approach is unsupervised and requires no labeled data. It also accurately detects network-wide anomalies without presuming that the training data is completely free of attacks. The evaluation of our intrusion detection method, on top of real network data, indicates that it can accurately detect resource exhaustion attacks and network profiling techniques of varying intensities. The developed method is efficient because a normality model can be learned by training an RNN within a few seconds only.
ISBN	978-1-5090-4379-8
In	14th Annual Conference on Privacy, Security and Trust (PST), p.317 - 324
Publisher	IEEE
Schlüssel	TUD-CS-2016-14643
Url	https://tubiblio.ulb.tu-darmstadt.de/id/eprint/101613

Analyzing Flow-based Anomaly Intrusion Detection using Replicator Neural Networks