Anomaly detection in TCP/IP networks / Joanna Kołodziej, Mateusz Krzysztoń, Paweł Szynkiewicz // W: ECMS 2023 : proceedings of the 37th ECMS International Conference on Modelling and Simulation, June ... więcej

Anomaly detection in TCP/IP networks / Joanna Kołodziej, Mateusz Krzysztoń, Paweł Szynkiewicz // W: ECMS 2023 : proceedings of the 37th ECMS International Conference on Modelling and Simulation, June 20th – June 23rd, 2023 Florence, Italy [Dokument elektroniczny] / ed. by Enrico Vicario [et al.] ; org. by ECMS - European Council for Modelling and Simulation. – Caserta : ECMS, 2023. – (European Conference for Modelling and Simulation, ISSN 2522-2422 ; Vol. 37, Iss. 1). – S. 542-548 : schem., tab., wykr. – Tryb dostępu: https://www.scs-europe.net/conf/ecms2023/ecms2023proceedings.pdf. – Bibliogr. 23 poz., Abstr. – Wydaw. wg cop. – Miejsce wyd. wg siedziby wydaw. – ISBN 978-3-937436-80-7 (Print). – ISBN 978-3-937436-79-1 (CD-ROM)

Intrusion Detection Systems (IDS) should be capa- ble of quickly detecting attacks and network traffic anomalies to reduce the damage to the network com- ponents. They may efficiently detect threats based ... więcej

Intrusion Detection Systems (IDS) should be capa- ble of quickly detecting attacks and network traffic anomalies to reduce the damage to the network com- ponents. They may efficiently detect threats based on prior knowledge of attack characteristics and the po- tential threat impact (’known attacks’). However, IDS cannot recognise threats, and attacks (’unknown at- tacks’) usually occur when using brand-new technolo- gies for system damage. This paper presents two security services – Net Anomaly Detector (NAD) and a signature-based PGA Filter for detecting attacks and anomalies in TCP/IP networks. Both services are modules of the cloud-based GUARD platform developed in the H2020 GUARD project. Such a platform was the main component of the simulation environment in the work presented in this paper. The provided experiments show that both modules achieved satisfactory results in detecting an unknown type of DoS attacks and signatures of DDoS attacks.