Abnormal Network Traffic Detection Based on Conditional Event Algebra

Network anomaly traffic detection can discover network abnormal behavior and unknown network attacks. But anomaly detection system in current has the disadvantage of the high rate of false positives. Because the condition is not sufficient and high-order conditional reasoning cannot be computed, it leads inaccurate detection of abnormal behavior. In this paper, an analysis method for abnormal network traffic detection is presented. The method firstly applied conditional event algebra for abnormal network traffic detection of Denial-of-Service (DoS) attacks on the 10% trainset of KDD Cup 99 data set. Neptune attack, as an instance of DoS attacks, is used to illustrate this method. Firstly of all, introducing analyzes the attack process of neptune attack. Then, Selecting the most related features of neptune attack on KDD Cup 99 data set and summarizes the basic flow chart of neptune attack. Finally, applying this method for detection of Neptune attack, it can be found that this method can handle with high-order conditional reasoning under insufficient situation, and detect network abnormal behavior.

Modeling frequency and type of interaction in event networks

Longitudinal social networks are increasingly given by event data, i.e., data coding the time and type of interaction between social actors. Examples include networks stemming from computer-mediated communication, open collaboration in wikis, phone call data, and interaction among political actors. In this paper we propose a general model for networks of dyadic, typed events. We decompose the probability of events into two components: the first modeling the frequency of interaction and the second modeling the conditional event type, i.e., the quality of interaction, given that interaction takes place. While our main contribution is methodological, for illustration we apply our model to data about political cooperation and conflicts collected with the Kansas Event Data System. Special emphasis is given to the fact that some explanatory variables affect the frequency of interaction while others rather determine the level of cooperativeness vs. hostility, if interaction takes place. Furthermore, we analyze if and how model components controlling for network dependencies affect findings on the effects of more traditional predictors such as geographic proximity or joint alliance membership. We argue that modeling the conditional event type is a valuable - and in some cases superior - alternative to previously proposed models for networks of typed events.