Conversation Exchange Dynamics: A New Signal Primitive for Computer Network Intrusion Detection

Authors

John C. McEachen, Naval Postgraduate School, Monterey, California
John M. Zachary, University of South Carolina - Columbia
Junling Wang, University of South Carolina - Columbia
Kah Wai Cheng, Naval Postgraduate School, Monterey, California

Date of this Version

12-22-2004

Comments

Published in 3rd Workshop on the Internet, Telecommunications and Signal Processing, Adelaide, Australia, December 20-22, 2004. Edited by Beata J Wysocki & Tadeusz A Wysocki. ISBN: 0-9756934-0-9.

Abstract

As distributed network intrusion detection systems expand to integrate hundreds and possibly thousands of sensors, managing and presenting the associated sensor data becomes an increasingly complex task. Methods of intelligent data reduction are needed to make sense of the wide dimensional variations. We present a new signal primitive we call conversation exchange dynamics (CED) that accentuates anomalies in traffic flow. This signal provides an aggregated primitive that may be used by intrusion detection systems to base detection strategies upon. Indications of the signal in a variety of simulated and actual anomalous network traffic from distributed sensor collections are presented. Specifically, attacks from the MIT Lawrence Livermore IDS data set are considered. We conclude that CED presents a useful signal primitive for assistance in conducting IDS.