Design and Implementation of an Anomaly Detection System: an Empirical Approach

Network management platforms provide flexible facilities for setting up custom applications able to detect network anomalies on a specific environment. This is because each network is made of users, services and computers with a specific behaviour that is then reflected in the generated network traffic. Goal of this paper is to show that in every network there are some global variables that can be profitably used for detecting network anomalies, regardless of the type of network users and equipment. As most of the relations among these variables are fixed, this paper shows that it is possible to define generic network rules aimed to automatically detect selected network anomalies. Finally, it covers the design and implementation of an open-source application used to effectively validate this work on a large campus network. 1 Background and Motivation This paper focuses on network-based intrusion detection and it explores a different approach to the problem. Intrusion detection techniques can be categorised into signature detection and anomaly detection [1][2]. Signature detection systems use patterns of well-known attacks or weak spots of the system to match and identify known intrusions. They perform a pattern matching between network traffic captured and attack signature. If the matching succeds, then the system generates an alarm. The main advantage of signature detection paradigm is that it can accurately and efficiently detect instances of known attacks. The main disadvantage is that it lacks the ability to detect the newly