LoSS Detection Using Parameter s Adjustment Based on Second Order Self- Similarity Statistical Model

Transcription

1 LoSS Detection Using Paraeter s Adjustent Based on Second Order Self- Siilarity Statistical Model Mohd Fo ad Rohani Faculty of Coputer Science and Inforation Systes, Universiti Tenologi Malaysia, 83 Sudai, Johor, Malaysia. foad@ut.y Ali Selaat Faculty of Coputer Science and Inforation Systes, Universiti Tenologi Malaysia, 83 Sudai, Johor, Malaysia. aselaat@ut.y Mohd Aizaini Maarof Faculty of Coputer Science and Inforation Systes, Universiti Tenologi Malaysia, 83 Sudai, Johor, Malaysia. aizaini@ut.y Houssain Kettani Departent of Electrical and Coputer Engineering and Coputer Science, Polytechnic University of Puerto Rico, San Juan, Puerto Rico 99, USA. hettani@pupr.edu Abstract This paper analyzes Loss of Self-Siilarity (LoSS) detection accuracy using paraeter s adjustent which includes different values of sapling level and correlation lag. This is iportant when considering exact and asyptotic self-siilar odels concurrently in the self-siilarity paraeter estiation ethod. Due to the needs of high accuracy and fast estiation, the Optiization Method (OM) based on Second Order Self-siilarity (SOSS) statistical odel was proposed in the previous wors to estiate self-siilarity paraeter. Consequently, Curve Fitting Error (CFE) value estiated fro OM is used to detect LoSS efficiently. This wor investigates the effect of the paraeter s adjustent for iproving the CFE accuracy and estiation tie speed. We have tested the ethod with real Internet traffics siulation that consists of noral and alicious pacets traffic. Our siulation results show that LoSS detection accuracy and estiation tie can be affected by the chosen of sapling level and correlation lag values.. Introduction The advance of attac tools and their availability on Internet have increased networ vulnerability to isuse and perforance traffic probles. Internet service providers are now faced with the challenging tas of continuous onitoring of their networ to ensure that security is aintained. Thus, onitoring Internet traffic especially to detect anoaly traffic is very iportant to assist security experts in analyzing and detecting alicious traffic behavior. The effort is needed by networ adinistrator in order to offer uninterrupted Internet services to the users. There are several odels that have been applied to detect anoaly traffic including statistical oents (or ean and standard deviation odel), ultivariate odel or tie series odel []. When dealing with huge aount of traffic pacets where behavior traffic eep changing unpredictably, anoaly detection using tie series odel is suggested since the odel can produce better results than others statistical odels []. Recent studies have shown that self-siilarity odel is widely used for Internet traffic odeling and analysis [3], [4], [5], [7], [8]. According to self-siilarity odel, the autocorrelation of inter arrival traffic pacets is assuing to exhibit hyperbolic decay and Long Range Dependent (LRD). This assuption is true for noral traffic but in the presence of alicious traffic such as Denial of Service (DoS) pacets, the self-siilarity distribution error [4] is introduced and perturbs the self-siilarity odel. Consequently, Loss of Self-siilarity (LoSS) is detected [],_[6],_[4] to /8/$5. 8 IEEE Proceedings of the 3rd International Syposiu on Inforation Technology (ITSi8), pp. 6-9, Kuala Lupur, Malaysia, August 8.

2 alert security analysts with the existence of uncontrolled self-siilarity structure in networ queue buffer [4], []. Thus, pacets queue buffer tie delay and pacets drop rates are drastically increased [4], [] hence degrading Quality of Service (QoS) perforance. Ipleentation of LoSS detection with Second Order Self-Siilarity (SOSS) statistical odel has been introduced due to high speed and accuracy needs [6]. Previous wors [], [6], however, have used fixed sapling tie series pacets which is insufficient to reveal self-siilarity distribution error correctly [], [3]. In this wor, we investigate LoSS detection accuracy and its dependency on two variables nown as sapling level and correlation lag. This is crucial when cobining the idea of exact and asyptotic selfsiilarity odels concurrently in the estiation ethod [9]. In our wor, we use Second Order Self-siilarity (SOSS) statistical odel and the Optiization Method (OM) [7] to estiate the self-siilarity paraeter. LoSS is detected if the Curve Fitting Error (CFE) estiated using OM exceeds the threshold value [6]. Anoaly traffic detection based on LoSS will suffer high false alar detection rate if iproper sapling level and insufficient correlation lag process are used in the estiation ethod [],_[3]. Thus, LoSS detection accuracy using different values of sapling levels and correlation lag are analyzed and the estiation tie processing speed is also investigated. This paper is organized as follows: Section discuses in brief the self-siilarity odel LoSS detection ethod. The experiental and epirical analyses are presented in Section 3. Finally, our conclusions and future wors are suarized in Section-4.. Self-Siilarity Model and LoSS Detection Method. SOSS Model and Estiation Method Let define a second-order stationary process X = { X( t), t > } with constant ean μ, finite variance σ and autocorrelation ρ ( ) as follow: μ σ μ = EXt [ ( )], = E[( Xt ( ) )] () ρ( ) E[( X( t) μ)( X( t ) μ)] / σ = + () ( ) ( ) Let X = { X ( t), t > } denotes the aggregate process of X at aggregation level >. Thus, we have: Let t ( ) X () t = X( w), t > (3) w = ( t ) + ( ) ρ ( ) denotes the autocorrelation function of ( ) X. X is called Exactly Second-Order Self-Siilar ( ) (ESOSS) if ρ( ) = ρ ( ) for all _ _. In ESOSS, the autocorrelation structure is preserved for all such that: ρ( ) = [( + ) + ( ) ] (4) where > and <β<. X is called Asyptotical Second-Order Self-Siilar (ASOSS) if li ρ ( ) ~ [( ) ( ) ] + + (5) where >, > and <β<. X is called Long-Range Dependent (LRD) if its autocorrelation function satisfies: ρ ( ) ~ c where, c> and <β<. There are several ethods to estiate H. In this paper we use OM that was developed in [7] which was proven relatively fast and accurate copared to other ethods such as the wavelet ethod. The OM defines Curve-Fitting Error (CFE) function as E K (β) such as: K E ( β)= ( ( ) ( )) K ρ ρ (6) n 4K = where ρ() denotes the autocorrelation function of the odel with paraeter β that we would lie to fit the data to, ρ n () is the saple autocorrelation function of the data, and K is the largest value of such that it iniize the edge effect for the calculation of ρ n (). If the iniu of E K (β) is less than -3, then the data fits the odel and the iniizer ˆβ is piced to be the estiate of the paraeter β [7].. LoSS Detection Using Paraetric Adjustent Let X(t) as a stochastic tie series data with second order stationary property. The autocovariance decay of X(t) and aggregated X () (t) should follow ESOSS odel which can be written in equation (7): li γ ( ) = γ( ) ~ C β (7) where is sapling level, is correlation lag, C o is constant and β is self-siilarity paraeter. In real Internet traffic, however, the self-siilarity processes are also considered as processes x(j) in the class X of those stationary processes that feature an asyptotic decay in autocovariance [9]. Thus, we /8/$5. 8 IEEE Proceedings of the 3rd International Syposiu on Inforation Technology (ITSi8), pp. 6-9, Kuala Lupur, Malaysia, August 8.

3 should consider ESOSS and ASOSS odels concurrently in order to estiate the self-siilarity paraeter for noral and abnoral traffic correctly. Let denotes autocovariance, variance and autocorrelation for aggregated process X () (t) as shown in equation (8), (9) and () [9]. li γ ( ) C β (8) li γ () ~ li ρ ( ) = li ~ C β (9) C ~ C γ ( ) γ () ~ β 3 C β () where C, C and C 3 are constants. The wors in [7], [8] have assued that noral Internet traffic follows ESOSS odel and its characteristics are shown in equations (8) to (). Equation () clearly deonstrates that autocorrelation decay does not affected by aggregation () paraeter. On the other hand, correlation lag () plays an iportant role to obtain high accuracy of self-siilarity paraeter (β) estiation. In the presence of alicious traffic such as DoS pacets, the high intensity of DoS pacets can disturb Internet traffic behavior and produce self-siilarity distribution error. Consequently, noral characteristics of equations (8) to () are not valid where LoSS is detected. Equation () shows that for abnoral traffic, the autocovariance and variance decay of C β and ' ( C β ) are not identical and not following noral self-siilarity pattern as in equation (). β γ ( ) C li ρ ( ) = li ' β γ () ( C ) ~ C 3 β () This shows that for detecting alicious traffic, aggregation and correlation lag are two paraeters that need to be considered for estiating the CFE value correctly in order to iprove LoSS detection accuracy. 3. Experiental and Epirical Analyses 3. Siulation Dataset We have siulated the FSKSMNet Internet traffic traces collected on Septeber 9, 6 at Faculty of Coputer Science and Inforation Systes (FCSIS) in order to evaluate the proposed LoSS detection approach [3]. The networ infrastructure consists of ten VLANs with BaseFX Fast Ethernet bacbone which is connected to university Gigabit bacbone. The siulation is divided into noral and abnoral traffic. Noral traffic is defined as Internet activities that strictly follow FCSIS networ policy. On the other hand, abnoral traffic contains siulated injection of DoS flooding pacets at controlled rate that includes TCP SYN and UDP flooding pacets. Each of siulation traces is about 3 inutes. Table shows the details of our siulated traffic protocols. The percentage protocol for noral traffic shows that alost 97% is doinated by TCP protocol while UDP is less than.5%. The ICMP, IGMP and others protocol are less than.5%. On the other hand, the siulated alicious traffic consists of 8% TCP SYN and 7% UDP flooding while noral protocols of TCP and UDP are 4% and 3%. The reainder is ICMP, IGMP and others which less than.5%. We use sapling level at icro sapling (i.e. below second) [], [3] that represents crucial engineering factor [] design for Internet odeling purpose. Different sapling levels for the traces used in our experients and their window size (or data length) are shown in Table. Trace Noral (.45p -.5p) Malicious (.46a-.6p) Table. FSKSMNet traffic siulation Tie Injection (SYN/UDP) None.55a (TCP SYN : 6s).5p (UDP flood : 6s) None Pacet s Count Protocol Noral DoS TCP UDP ICMP 5436 None IGMP 93 Others 55 TCP UDP ICMP 3599 IGMP 476 Others 99 None Table. Details sapling of siulation dataset Sapling Level (s) Noral (N) Window Size Malicious (M) Window Size N M N M N 7399 M 7399 N 8699 M N M N M N 739 M /8/$5. 8 IEEE Proceedings of the 3rd International Syposiu on Inforation Technology (ITSi8), pp. 6-9, Kuala Lupur, Malaysia, August 8.

4 3. LoSS Detection with Paraetric Adjustent The siulation result of CFE estiation using different values of sapling level and correlation lag for noral trace is illustrated in Figure. Figure clearly shows that the estiated CFE value for noral trace at all sapling levels and correlation lags are below the threshold. The result shows that sapling level and correlation lag do not influence uch on estiating the CFE value correctly for noral traffic that follows ESOSS odel. Different sapling level will produce different window pacets size while different correlation lag will give different estiation tie process. In certain fixed capturing tie duration, higher sapling level will produce saller window pacets size copared to lower sapling level. When window size pacet is too sall, it is possible to estiate the self-siilarity paraeter incorrectly due to insufficient data that do not fulfill the iniu window requireent [6]. On the other hand, the increasing of correlation lag value can increase the correlation tie speed processing. Thus, previous wors [8] on estiating self-siilarity paraeter for noral traffic use sall sapling level such as s or s and use sall correlation lag such as 5 [7]. as s, the sapling level is insufficient to reveal LoSS occurrences despite using large value of correlation lag. Consequently, LoSS detection accuracy can be iproved further by increasing higher sapling level such as larger than s and suitable correlation lag such as larger than is used. The details of CFE estiation are presented in Table 3. As shown in Table 3, at sapling level s none of LoSS is detected even though large correlation lag are used. This can be a possible reason for high false alar detection if LoSS is detected at s. On the other hand, by increasing sapling level to the higher value, LoSS detection accuracy can be iproved. For instance, at sapling level s if sall correlation lag is chosen lower than, LoSS is not detected but % detected if correlation lag larger than is used. At higher sapling such as larger than 5s, however, the accuracy of LoSS is % detected regardless the value of correlation lag used. This observation deonstrates that choosing a proper value of sapling and correlation lag is iportant in order to detect LoSS correctly..5. estiate threshold x -4 estiate threshold LoSS ( CFE ) LoSS ( CFE ) Aggregation ( s ) 7 5 Lag ( K ) Aggregation ( s ) Lag ( K ) Figure. LoSS detection for noral trace For alicious traffic, however, proper values of sapling level and correlation lag are needed in order to estiate LoSS correctly. Figure illustrates LoSS estiation based on CFE for alicious traffic trace. As shown in Figure, the accuracy of CFE estiation for alicious traffic is influenced by the sapling level and correlation lag values. At very sall sapling such Figure. LoSS detection for alicious trace Table 3. Details CFE estiation for alicious trace Trace Auto-correlation lag () (M) M M M M M M M /8/$5. 8 IEEE Proceedings of the 3rd International Syposiu on Inforation Technology (ITSi8), pp. 6-9, Kuala Lupur, Malaysia, August 8.

5 3.3 LoSS Detection Perforance Our siulation results show that for noral traffic that follows ESOSS odel, zero LoSS is detected despite a different set of sapling level (fro s to s) and correlation lag (fro 5 to 5) are used in the estiation. This deonstrates that paraeter s adjustent has less effect on the LoSS detection for noral traffic. This eans that sall sapling such as s or s as used in [8] and sall correlation lag such as 5 as used in [7] are sufficient to estiate selfsiilarity paraeter correctly. On the other hand, LoSS detection for alicious traffic trace has different accuracy when applying different value of sapling level and correlation. The details of LoSS detection perforance for alicious trace are shown in Table 4. The results deonstrate that a proper selection of paraeter adjustent is needed in order to reduce false alar LoSS detection. As shown in Table 4, zero LoSS is detected at sapling level s but significantly iproved to % detected at sapling level higher than 5s regardless any values of correlation lags are used. The results also show that LoSS detection accuracy for sapling level between s and 5s is very uch depending on the chosen of correlation lag value. For instance, sapling level s requires correlation lag above to detect LoSS successfully copared to sall correlation lag. Siilarly, sapling level s needs correlation lag above for LoSS is fully detected. Table 5. LoSS detection perforance for alicious trace Trace (M) Autocorrelation lag () M No No No No No No M 5 No No No No Yes Yes M No No Yes Yes Yes Yes M No Yes Yes Yes Yes Yes M 5 Yes Yes Yes Yes Yes Yes M 7 Yes Yes Yes Yes Yes Yes M Yes Yes Yes Yes Yes Yes The different between saller and higher sapling level is window size produced fro certain duration of capturing tie. A saller sapling produces a larger window size copared to a higher sapling level. In our siulation for 3 inutes traffic capturing, sapling level at s, s and s provide window size of 7399, 7399 and 739 pacets respectively. The advantage of sall sapling is less tie needed to fulfill iniu window requireent [6] for initialization process before paraeter estiation can be done correctly. On the other hand, LoSS can be possibly hidden under sall sapling level. Therefore, LoSS detection perforance can be iproved by cobining proper selection of sapling level and correlation lag values. Another paraeter to be considered for developing a reliable LoSS detection ethod is estiation tie factor. Figure 3 illustrates the processing tie for estiating LoSS detection using different values of sapling level and correlation lag. The result deonstrates that different window size pacet fro different sapling level has given different estiation tie processing. The longer window size pacet is used, the longer tie processing is needed. Elapse Tie ( s ) Elapse Tie ( s ) =s, w=7399 =s, w=7399 =5s, w= Lag ( ) (a) =5s, w=34798 =s, w=8699 =s, w= Lag ( ) (b) Figure 3. LoSS detection elapse estiation tie for alicious trace /8/$5. 8 IEEE Proceedings of the 3rd International Syposiu on Inforation Technology (ITSi8), pp. 6-9, Kuala Lupur, Malaysia, August 8.

6 As shown in Figure 3(a), sapling level s and s produce alost the longest and shortest estiation tie than others at all correlation lag values. Another iportant observation is that at each sapling level, the increasing of correlation lag will also increases the estiation tie processing. This can be seen in saller sapling level such as s in Figure 3(a) or at larger sapling level in Figure 3(b). The results show that correlation lag equal 5 taes less estiation tie copared to 5 at alost all sapling levels. Fro the siulation results, a general guideline in order to achieve an accurate LoSS detection using OM as well as to optiize estiation tie can be followed. If sall sapling level is used then correlation lag ust be assigned with bigger value. On the other hand, larger sapling level needs saller value of correlation lag that can sufficiently reveal the existence of selfsiilarity distribution error efficiently. Further efforts, however, should be done in order to deterine an optiize value of sapling level and correlation lag paraeters in order to optiize LoSS detection accuracy perforance. 4. Conclusions and Future Wors Paraeter s adjustent which includes sapling level and correlation lag are identified as a prie factor that can influence LoSS detection accuracy. The siulation results show that sapling level does not influence CFE estiation for noral traffic that follows ESOSS odel. The accuracy of the estiated CFE, however, is very uch depending on correlation lag paraeters. On the other hand, both paraeters sapling level and correlation lag have a significant effect on the CFE estiation accuracy for alicious traffic. Our results show that LoSS is possibly hidden either at sall sapling level or correlation lag which can contribute to false alar detection. The higher sapling level can increase LoSS detection accuracy provided the window size is sufficient. Siilarly, the increent of correlation lag can reduce overall detection perforance where the estiation tie is increased. Therefore, sapling level and correlation lag can affect the perforance of LoSS detection for both accuracy and speed. We plan to test the proposed analysis ethod to various Internet traffic datasets in future to study the reliability of the ethod. 6. Acnowledgents This wor was funded by Universiti Tenologi Malaysia and Ministry of Science and Innovation Malaysia. The authors are grateful to Dr. Sulaian Mohd Noor and Mr. Firoz for their helps in preparing the siulation of FSKSMNet dataset. 7. References [] Allen, W. H. and Marin, G.A., The LoSS technique for detecting new Denial of Service attacs, SoutheastCon, 4. Proceedings. IEEE, 6-9 March 4, pp [] Cairano-Gilfedder, C. and Clegg, R.G., A decade of Internet research -- advances in odels and practices, BT Technology Journal 3, vol.4, Oct. 5, pp [3] Crovella, M.E. and Bestavros, A. Self-siilarity in World Wide Web traffic: Evidence and possible causes networing, IEEE/ACM Transactions on Networing, Volue 5, Issue 6, Deceber 997, pp [4] Errailli, A., Narayan, O. and Willinger, W., Experiental queueing analysis with long-range dependent pacet traffic, Transactions on Networing, Vol(4), 996, pp [5] Feldann, A., Gilbert, A.C., Willinger, W. and Kurtz, T.G., The changing nature of networ traffic: scaling phenoena, ACM Coputer Counication, Vol.8(), April 998, pp [6] Idris, M. Y., Abdullah, A. H. and Maarof, M. A., Iterative window size estiation on self-siilarity easureent for networ traffic anoaly detection, International Journal of Coputing and Inforation Science, (IJCIS), Vol. (), 4, pp [7] Kettani, H., A Novel Approach to the Estiation of the Long-Range Dependence Paraeter, University of Wisconsin Madison : PhD. Thesis,. [8] Leland, W., Taqqu, M., Willinger, W. and Wilson, D., On the self-siilar nature of Ethernet traffic, Proceedings of ACM SIGCOMM, Vol. 3(4), 993, pp [9] Mazzini, G., Rovatti, R. and Setti, G., "On the Aggregation of Self-Siilar Processes," IEICE Transactions Fundaentals, Vol.E88 A (), October 5, pp [] Par, K., Ki, G. and Crovella, M., On the effect of traffic self-siilarity on networ perforance, Proceedings /8/$5. 8 IEEE Proceedings of the 3rd International Syposiu on Inforation Technology (ITSi8), pp. 6-9, Kuala Lupur, Malaysia, August 8.

7 of SPIE International Conference on Perforance and Control of Networ Systes, Noveber 997. [] Qayyu, A., Isla, M.H., Jail, M., "Taxonoy of statistical based anoaly detection techniques for intrusion detection," Eerging Technologies, 5. Proceedings of the IEEE Syposiu on, 7-8 Sept. 5, pp [] Rohani, M.F., Maarof, M.A., Selaat, A. and Kettani, H., Uncovering Anoaly Traffic Based on Loss of Self- Siilarity Behavior Using Second Order Statistical Model, International Journal of Coputer Science and Networ Security (IJCSNS), Vol.7(9), pp 6-, Septeber 7. [3] Rohani, M.F., Maarof, M.A., Selaat, A. and Kettani, H., Loss of Self-Siilarity Detection with Second Order Statistical Model and Multi-Level Aggregation Approach, Proceedings of the International Conference on Robotics, Vision, Inforation and Signal Processing ROVISP7, 8-3 Noveber 7, pp [4] Schleifer, W. and Mannle, M., Online error detection through observation of traffic self-siilarity, IEE Proceedings on Counications, 48(), Feb /8/$5. 8 IEEE Proceedings of the 3rd International Syposiu on Inforation Technology (ITSi8), pp. 6-9, Kuala Lupur, Malaysia, August 8.