The New Jersey Institute of Technology's
Electronic Theses & Dissertations Project

Title:	Network anomaly detection using management information base (MIB) network traffic variables
Author:	Li, Jun
View Online:	njit-etd2004-124 (xvi, 101 pages ~ 9.6 MB pdf)
Department:	Department of Electrical and Computer Engineering
Degree:	Doctor of Philosophy
Program:	Electrical Engineering
Document Type:	Dissertation
Advisory Committee:	Manikopoulos, Constantine N. (Committee chair) Akansu, Ali N. (Committee member) Hou, Edwin (Committee member) Tekinay, Sirin (Committee member) Antoniou, George (Committee member)
Date:	2004-08
Keywords:	Network anomaly Network anomaly detection Management information base Probability density function
Availability:	Unrestricted
Abstract:	In this dissertation, a hierarchical, multi-tier, multiple-observation-window, network anomaly detection system (NADS) is introduced, namely, the MIB Anomaly Detection (MAD) system, which is capable of detecting and diagnosing network anomalies (including network faults and Denial of Service computer network attacks) proactively and adaptively. The MAD system utilizes statistical models and neural network classifier to detect network anomalies through monitoring the subtle changes of network traffic patterns. The process of measuring network traffic pattern is achieved by monitoring the Management Information Base (Mifi) II variables, supplied by the Simple Network Management Protocol (SNMP) LI. The MAD system then converted each monitored Mifi variable values, collected during each observation window, into a Probability Density Function (PDF), processed them statistically, combined intelligently the result for each individual variable and derived the final decision. The MAD system has a distributed, hierarchical, multi-tier architecture, based on which it could provide the health status of each network individual element. The inter-tier communication requires low network bandwidth, thus, making it possibly utilization on capacity challenged wireless as well as wired networks. Efficiently and accurately modeling network traffic behavior is essential for building NADS. In this work, a novel approach to statistically model network traffic measurements with high variability is introduced, that is, dividing the network traffic measurements into three different frequency segments and modeling the data in each frequency segment separately. Also in this dissertation, a new network traffic statistical model, i.e., the one-dimension hyperbolic distribution, is introduced.