Principal Component Analysis of Port-scans for Reduction of Distributed Sensors

スポンサーリンク

概要

• 論文の詳細を見る

• There are many studies aimed at using port-scan traffic data for fast and accurate detection of rapidly spreading worms. This paper proposes two new methods for reducing the traffic data to a simplified form comprising of significant components of smaller dimensionality. (1) Dimension reduction via Principal Component Analysis (PCA), widely used as a tool in exploratory data analysis, enables estimation of how uniformly the sensors are distributed over the reduced coordinate system. PCA gives a scatter plot for the sensors, which helps to detect abnormal behavior in both the source address space and the destination port space. (2) One of the significant applications of PCA is to reduce the number of sensors without losing the accuracy of estimation. Our proposed method based on PCA allows redundant sensors to be discarded and the number of packets estimated even when half of the sensors are unavailable with accuracy of less than 3% of the total number of packets. In addition to our proposals, we report on experiments that use the Internet Scan Data Acquisition System (ISDAS) distributed observation data from the Japan Computer Emergency Response Team (JPCERT)★1.

• 2010-09-15

著者

• Hiroaki Kikuchi

  School of Information and Network Engineering, Tokai University

• Masato Terada

  Hitachi, Ltd. Hitachi Incident Response Team (HIRT)

• Masato Terada

  Hitachi Ltd. Hitachi Incident Response Team (hirt)

• Hiroaki Kikuchi

  Tokai University

関連論文

• Principal Component Analysis of Port-scans for Reduction of Distributed Sensors
• Frequent Sequential Attack Patterns of Malware in Botnets
• Frequent Sequential Attack Patterns of Malware in Botnets
• Automated Port-scan Classification with Decision Tree and Distributed Sensors
• Estimation of Increase of Scanners Based on ISDAS Distributed Sensors
• Principal Component Analysis of Botnet Takeover
• Perfect Privacy-preserving Automated Trust Negotiation
• Mining Botnet Coordinated Attacks using Apriori-PrefixSpan Hybrid Algorithm (Preprint)

スポンサーリンク