Distributed, Multi-Level Network Anomaly Detection for Datacentre Networks

Iordache, M., Jouet, S., Marnerides, A. K. and Pezaros, D. P. (2017) Distributed, Multi-Level Network Anomaly Detection for Datacentre Networks. In: IEEE ICC 2017 Next Generation Networking and Internet Symposium, Paris, France, 21-25 May 2017, ISBN 9781467389990 (doi:10.1109/ICC.2017.7996569)

[img]
Preview
Text
137536.pdf - Accepted Version

426kB

Abstract

Over the past decade, numerous systems have been proposed to detect and subsequently prevent or mitigate security vulnerabilities. However, many existing intrusion or anomaly detection solutions are limited to a subset of the traffic due to scalability issues, hence failing to operate at line-rate on large, highspeed datacentre networks. In this paper, we present a two-level solution for anomaly detection leveraging independent execution and message passing semantics. We employ these constructs within a network-wide distributed anomaly detection framework that allows for greater detection accuracy and bandwidth cost saving through attack path reconstruction.Experimental results using real operational traffic traces and known network attacks generated through the Pytbull IDS evaluation framework, show that our approach is capable of detecting anomalies in a timely manner while allowing reconstruction of the attack path, hence further enabling the composition of advanced mitigation strategies. The resulting system shows high detection accuracy when compared to similar techniques, at least 20% better at detecting anomalies, and enables full path reconstruction even at smallto- moderate attack traffic intensities (as a fraction of the total traffic), saving up to 75% of bandwidth due to early attack detection.

Item Type:Conference Proceedings
Status:Published
Refereed:Yes
Glasgow Author(s) Enlighten ID:Jouet, Mr Simon and Iordache Sica, Mr Mircea and Pezaros, Dr Dimitrios
Authors: Iordache, M., Jouet, S., Marnerides, A. K., and Pezaros, D. P.
College/School:College of Science and Engineering > School of Computing Science
ISSN:1938-1883
ISBN:9781467389990
Copyright Holders:Copyright © 2017 IEEE
First Published:First published in 2017 IEEE International Conference on Communications (ICC)
Publisher Policy:Reproduced in accordance with the publisher copyright policy

University Staff: Request a correction | Enlighten Editors: Update this record

Project CodeAward NoProject NamePrincipal InvestigatorFunder's NameFunder RefLead Dept
643481A Situation-aware information infrastructureDimitrios PezarosEngineering & Physical Sciences Research Council (EPSRC)EP/L026015/1COM - COMPUTING SCIENCE
709131Network Measurement as a Service (MaaS)Dimitrios PezarosEngineering & Physical Sciences Research Council (EPSRC)EP/N033957/1COM - COMPUTING SCIENCE
722161FRuIT: The Federated RaspberryPi Micro-Infrastructure TestbedJeremy SingerEngineering & Physical Sciences Research Council (EPSRC)EP/P004024/1COM - COMPUTING SCIENCE
608831IMC2: Instrumentation, Measurement and Control for the CloudDimitrios PezarosEngineering & Physical Sciences Research Council (EPSRC)EP/L005255/1COM - COMPUTING SCIENCE