In recent years, intrusion detection has become an important topic in data analytics for network protection and security measures. In this paper, a new diagnostic method for data recorded over a working computer network is presented. It can be used in information security applications such as intrusion detection and prevention. The proposed technique considers a generalized correlation data representation and applies a digit distribution. The current techniques were evaluated, documented, and presented by conducting various tests on the recorded features of the network using the UNSW-NB15 dataset. The evaluation results illustrate the high-detection rates achieved.
Garcia-TeodoroPDiaz-VerdejoJMarcia-FernandezG, et al.Anomaly-based network intrusion detection: Techniques, systems and challenges. Comput Secur2009; 28: 18–28.
2.
IrelandE. Intrusion detection with genetic algorithms and fuzzy logic. In: UMMC Sci senior seminar conference, Morris, MN, December 2013, pp.1–30.
3.
KunduASuralSMajumdarAK. Database intrusion detection using sequence alignment. Int J Inf Secur2010; 9: 179–191.
4.
Mc HughJ. Intrusion and intrusion detection. Int J Inf Secur2001; 1: 14–35.
5.
AhsanMMashuriMLeeMH, et al.Robust adaptive multivariate Hotelling’s T2 control chart based on kernel density estimation for intrusion detection system. Expert Syst Appl2020; 145: 113105.
6.
ChountasisSPappasDSklavounosD. Network intrusion detection method based on matrix factorization of their time and frequency representations. ETRI J2020; 43: 152–162.
7.
GrochenigKJamingPMalinnikovaE. Zeros of the wigner distribution and the short-time Fourier transform. Rev Mat Comput2020; 33: 723–744.
8.
KurniawanYIndraFRaziF, et al.Naive Bayes modification for intrusion detection system classification with zero probability. Bull Electr Eng Inform2021; 10: 2751–2758.
9.
SethiKKumarRPrajapatiN, et al.A lightweight intrusion detection system using Benford’s law and network flow size difference. In: 2020 international conference on communication systems and networks (COMSNETS), Bengaluru, India, 2020, pp. 1–6. DOI: https://doi.org/10.1109/COMSNETS48256.2020.9027422.
10.
XuXAliSYueT. Digital twin-based anomaly detection in cyber-physical systems. In: 14th IEEE conference on software testing, verification and validation (ICST), Porto de Galinhas, Brazil, 2021. pp. 205–216. DOI: https://doi.org/10.1109/ICST49551.2021.00031.
BouyeddouBHarrouFKadriB. Detecting network cyber-attacks using an integrated statistical approach. Cluster Comput2020; 24: 1435–1453.
13.
PrandlSLazarescuMSohST, et al.An investigation of power law probability distributions for network anomaly detection. In: 2017 IEEE symposium on security and privacy workshops (SPW), San Jose, CA, USA, 2017. pp. 217–222. DOI: https://doi.org/10.1109/SPW.2017.20.
14.
ChahiraJKirukiJKemeiP. A review of intrusion alerts correlation frameworks. Int J Comput Appl Technol Res2016; 5: 226–233.
15.
LuWGhorbaniAA. Network anomaly detection based on wavelet analysis. EURASIP J Adv Signal Process2009; 2009: Article number: 837601.
16.
HamdiMMeddeb-MakhloufABoudrigaN. Multilayer statistical intrusion detection in wireless networks. EURASIP J Adv Signal Process2009; 2009: Article number: 368589.
17.
ZonglinLGuangminHXingmiaoY. Detecting distributed network traffic anomaly with network-wide correlation analysis. EURASIP J Adv Signal Process2008; 2009: Article number: 752818.
18.
DurtschiCHillisonWPaciniC. The effective use of Benford’s law in detecting fraud in accounting data. J Forensic Account2004; 5: 17–34.
CohenL. Time-frequency distributions – A review. Proc IEEE1989; 77: 941–981.
21.
HlawatschFBoudreaux-BartelsGF. Linear and quadratic time-frequency signal representations. IEEE Signal Process Mag1992; 9: 21–67.
22.
DemangeB. Uncertainty principles for the ambiguity function. J Lond Math Soc2005; 72: 717–730.
23.
BenfordF. The law of anomalous numbers. Proc Am Philos Soc1938; 78: 551–572.
24.
HenselmannKDitterDScherrE. Irregularities in accounting numbers and earnings management a novel approach based on SEC XBRL filings. Journal of Emerging Technologies in Accounting2015: 117–151. https://doi.org/10.2139/ssrn.2297355
25.
ArshadiLJahangirAH. Benford’s law behavior of internet traffic. J Netw Comput Appl2014; 40: 194–205.
26.
NigriniM. Applications for forensic accounting, auditing and fraud detection. Hoboken, NJ: John Wiley and Sons, 2012.
27.
MoustafaNSlayJ. UNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). In: 2015 IEEE military communications and information systems conference (MilCIS) Canberra, ACT, Australia, 2015, pp. 1–6. DOI: https://doi.org/10.1109/MilCIS.2015.7348942.
28.
MoustafaNSlayJ. The significant features of the UNSW-NB15 and the KDD99 data sets for network intrusion detection systems. In: 2015 4th international workshop on building analysis datasets and gathering experience returns for security (BADGERS), Kyoto, Japan, 2015, pp. 25–31. DOI: https://doi.org/10.1109/BADGERS.2015.014
29.
MoustafaNSlayJ. The evaluation of network anomaly detection systems: Statistical analysis of the UNSW-NB15 data set and the comparison with the KDD99 data set. Inf Secur J2016; 25: 18–31.
30.
SteedAOliveiraMF. Networked graphics. Burlington, Massachusetts: Morgan Kaufmann, 2010.
31.
SangodoyinASigweleTPillaiP, et al.DoS attack impact assessment on software defined networks. In: Proceedings of the 9th International Conference on Wireless and Satellite Systems, WiSATS 2017 – Oxford, United Kingdom, Springer, 2018. pp. 11–22. DOI: https://doi.org/10.1007/978-3-319-76571-62.
32.
KossovskyAE. On the mistaken use of the chi-square test in Benford’s law. Stats2021; 4: 419–453.
