Abnormal Network Traffic Detection Based on Conditional Event Algebra

Network anomaly traffic detection can discover network abnormal behavior and unknown network attacks. But anomaly detection system in current has the disadvantage of the high rate of false positives. Because the condition is not sufficient and high-order conditional reasoning cannot be computed, it leads inaccurate detection of abnormal behavior. In this paper, an analysis method for abnormal network traffic detection is presented. The method firstly applied conditional event algebra for abnormal network traffic detection of Denial-of-Service (DoS) attacks on the 10% trainset of KDD Cup 99 data set. Neptune attack, as an instance of DoS attacks, is used to illustrate this method. Firstly of all, introducing analyzes the attack process of neptune attack. Then, Selecting the most related features of neptune attack on KDD Cup 99 data set and summarizes the basic flow chart of neptune attack. Finally, applying this method for detection of Neptune attack, it can be found that this method can handle with high-order conditional reasoning under insufficient situation, and detect network abnormal behavior.