Publication Type : Journal Article
Thematic Areas : Amrita Center for Cybersecurity Systems and Networks
Publisher : Journal of Intelligent and Fuzzy Systems, IOS Press,
Source : Journal of Intelligent and Fuzzy Systems, IOS Press, Volume 32, Number 4, p.2901-2907 (2017)
Url : https://www.scopus.com/inward/record.uri?eid=2-s2.0-85016785293&doi=10.3233%2fJIFS-169233&partnerID=40&md5=96781e9cd71bde9b0dc0a0a189306b96
Keywords : Anomaly detection, Collateral damage, Domain name system, False positive, hit analysis, Intelligent systems, Internet protocols, Knowledge base, Knowledge based systems, Lightweight frameworks, Soft computing, Traffic anomalies
Campus : Amritapuri
School : Center for Industrial Research and Innovation, Centre for Cybersecurity Systems and Networks
Center : Cyber Security
Department : cyber Security
Year : 2017
Abstract : Anomalous traffics are those unusual and colossal hits a non-popular domain gets for a small epoch period in a day. Regardless of whether these anomalies are malicious or not, it is important to analyze them as they might have a dramatic impact on a customer or an end user. Identifying these traffic anomalies is a challenge, as it requires mining and identifying patterns among huge volume of data. In this paper, we provide a statistical and dynamic reputation based approach to identify unpopular domains receiving huge volumes of traffic within a short period of time. Our aim is to develop and deploy a lightweight framework in a monitored network capable of analyzing DNS traffic and provide early warning alerts regarding domains receiving unusual hits to reduce the collateral damage faced by an end-user or customer. The authors have employed statistical analysis, supervised learning and ensemble based dynamic reputation of domains, IP addresses and name servers to distinguish benign and abnormal domains with very low false positives. © 2017-IOS Press and the authors. All rights reserved.
Cite this Research Publication : A. Ashok, Poornachandran, P., Pal, S., Sankar, P., and Surendran, K., “Why so abnormal? Detecting domains receiving anomalous surge traffic in a monitored network”, Journal of Intelligent and Fuzzy Systems, vol. 32, pp. 2901-2907, 2017.