A study on network anomaly detection and robust transport service using multipath TCP

Abstract

As the potential damage caused by malicious network activities has become more serious, the need to defend against these threats has increased significantly. The network intrusion detection system (NIDS), as a vital system in the network security infrastructure, aims to detect attacks quickly and accurately; its role is becoming more important. To achieve computationally efficient and effective anomaly detection, the classifier should be developed on reduced datasets that sufficiently represent all of the instances in the original dataset through the feature dimensionality reduction. In Content Distribution Networks (CDNs) and Peer-to-Peer (P2P) file-sharing applications, the download protocols that establish multiple TCP connections from one client to multiple servers allow users to take ad-vantage of enhanced throughput via the bandwidth aggregation of multiple connections and to improve end-to-end latency by taking advantage of servers with short round-trip times. Unfortunately, the performance gain for a multipath connection application may lead to severe unfairness for a concurrent single-flow download sharing the same bottleneck. Specifically, the multipath download can degrade or even starve the throughput of concur-rent single-flow applications or can have an undesirable effect on interactive or delay-sensitive applications. Similarly, the server may reject new connections due to resource shortage, leading to a denied service for single-flow downloads. Therefore, it is important for multipath download protocols to be able to balance fairness and performance, depending on network dynamics. For robust network anomaly detection and transport service, we propose a hierarchical approach for efficient network anomaly detection and fairness-aware multipath download protocol based on robust transport coordinator. First, a hierarchical method for efficient network anomaly detection is proposed. Statistical modeling re-mains the most common approach to anomaly d...