Statistical traffic modeling for network intrusion detection

This paper examines the application of Statistical Traffic Modeling for detecting navel attacks against computer networks. We discuss the application of Network: Activity Models and Application Models using the 1998 DARPA Intrusion Detection Evaluation dataset. Network Activity Models monitor the volume of traffic in the network, while Application Models describe the operation of application protocols. By plotting the ROC (Receiver Operating Characteristc) curves induced by the traffic activity, we quantify the effectiveness of Network Activity Models in discriminating normal connections from attack connections generated by Denial-of-Service and Probing attacks. it is verified that Denial-of-Service and Probing attacks leave traces on simple Network Activity Models, with rates of false alarm which are comparable to the false alarm rates obtained by the participants of the 1998 DARPA Evaluation, in which much more complex detection schemes were utilized. For Application Models, we use the Kolmogorov-Smirnov Test to show that attacks using telnet connections in the DARPA dataset form a population which is statistically different from the normal telnet connections. The statistics used in our study are the number of bytes from the responder; and the byte ratio responder-originator: Again, our results are comparable to those obtained in the DARPA Evaluation.