Network Anomaly Detection by IP Flow Graph Analysis: A DDoS Attack Case Study

Abstract

This paper introduces a novel approach for anomaly detection. The solution consists of an automatic detection system that operates without the need of network administrator intervention. Network IP flows are modeled by a graph and Tsallis entropy is applied in order to detect anomalies. Furthermore, our solution can extract and present detailed information from the network traffic. It provides to the network administrator a wide view of the damages that network anomalies cause. In order to evaluate the effectiveness of the proposed solution, it was used real data collected from a DDoS attack.