An Approach to Model Normal Network Behaviors Based on Entire Network Packets

Abstract

Anomaly detection can detect unknown or new intrusions, and there are increasing interest in it. A normal network behavior model is necessary in any anomaly detection. Assuming that abnormal network behaviors are obviously different from normal ones, there should be some abnormal network packets that are obviously different from normal packets. Normal network packets are disassembled into binary strings whose lengths are l, and all the strings construct a set U_normal. The normal network behavior model is a set U_model. The length of each element in U_model is also l. U_model is made up of those elements each of which matches at least one element in U_normal and doesn't match any other element in U_model. Normal network behaviors hide in U_model. The size of U_model is discussed. Experimental results indicate that abnormal network behaviors can feasibly be detected with U_model. Further work is to construct a more feasible U_model to put into practice.