Abstract
In order to maintain network security, it is very important to identify services with abnormal behavior and take targeted measures to prevent abnormal behaviors. We propose abnormal service identification mechanism based on behavior similarity. This method proposes a formula for service behavior similarity calculation of flow ports for services with correlation. And then k-similarity clustering algorithm is proposed to find abnormal service behaviors. Meanwhile, we analyse outliers to improve the accuracy of clustering results. At last, the experimental results show that k-similarity clustering algorithm can differentiate abnormal services accurately.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
Guo, Y.T., Gao, Y., Wang, Y.: DPI & DFI: a malicious behavior detection method combining deep packet inspection and deep flow inspection. Procedia Eng. 174, 1309–1314 (2017)
Parvat, T.J., Chandra, P.: Performance improvement of deep packet inspection for Intrusion Detection. In: Wireless Computing and Networking, pp. 224–228. IEEE (2015)
Zhou, Y., Wang, Y., Ma, X.: A service behavior anomaly detection approach based on sequence mining over data streams. In: International Conference on Parallel and Distributed Computing, Applications and Technologies. IEEE (2017)
Shi, Q., Xu, L., Shi, Z., Chen, Y., Shao, Y.: Analysis and research of the campus network service’s behavior based on k-means clustering algorithm. In: 2013 Fourth International Conference on Digital Manufacturing & Automation, pp. 196–201 (2013)
Parwez, M.S., Rawat, D.B., Garuba, M.: Big data analytics for service-activity analysis and service-anomaly detection in mobile wireless network. IEEE Trans. Ind. Inform. 13(4), 2058–2065 (2017)
Cao, J., Chen, A., Widjaja, I., et al.: Online identification of applications using statistical behavior analysis. In: Global Telecommunications Conference, pp. 1–6. IEEE (2008)
Bernaille, L., Teixeira, R., Akodkenou, I., Soule, A., Salamatian, K.: Traffic classification on the fly. ACM SIGCOMM Comput. Commun. Rev. 36(2), 23–26 (2006)
Moore, A.W., Papagiannaki, K.: Toward the accurate identification of network applications. In: International Conference on Passive and Active Network Measurement, pp. 41–54. Springer (2005)
Nychis, G., Sekar, V., Andersen, D.G., Kim, H., Zhang, H.: An empirical evaluation of entropy-based traffic anomaly detection. In: Internet Measurement Conference, pp. 151–156 (2008)
Zhou, Y.J.: Behavior analysis based traffic anomaly detection and correlation analysis for communication networks. University of Electronic Science and Technology of China (2013)
Wei, S., Mirkovic, J., Kissel, E.: Profiling and clustering internet hosts. In: International Conference on Data Mining, Las Vegas, Nevada, USA, pp. 269–275. DBLP (2006)
Xu, K., Wang, F., Gu, L.: Behavior analysis of internet traffic via bipartite graphs and one-mode projections. IEEE/ACM Trans. Netw. 22(3), 931–942 (2014)
Gordeev, M.: Intrusion detection techniques and approaches. Comput. Commun. 25(15), 1356–1365 (2008)
Rajaraman, A., Ullman, J.D.: Bigdata: large scale data mining and distributed processing. China Sci. Technol. Inf. (22), 26 (2012)
Acknowledgment
This work was financially supported by Research and Application on Intelligent Operation Management Technology in Voice Exchange Network (036000KK52160009) hosted by Power Grid Dispatching Control Center of Guangdong Power Grid Co., Ltd., China Southern Power Grid.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2020 Springer Nature Switzerland AG
About this paper
Cite this paper
Jiang, Y., Chen, Y., Hu, F., Zhang, G., Lin, P. (2020). Behavior Similarity Awared Abnormal Service Identification Mechanism. In: Liu, Q., Mısır, M., Wang, X., Liu, W. (eds) The 8th International Conference on Computer Engineering and Networks (CENet2018). CENet2018 2018. Advances in Intelligent Systems and Computing, vol 905. Springer, Cham. https://doi.org/10.1007/978-3-030-14680-1_35
Download citation
DOI: https://doi.org/10.1007/978-3-030-14680-1_35
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-14679-5
Online ISBN: 978-3-030-14680-1
eBook Packages: Intelligent Technologies and RoboticsIntelligent Technologies and Robotics (R0)