A Dependable Monitoring Mechanism Combining Static and Dynamic Anomaly Detection for Network Systems

Abstract

Due to abuse by insiders or penetration by outsiders, network systems usually suffer various security issues. In order to achieve high dependable and low cost monitoring, this paper proposes a dependable monitoring mechanism combining static threshold-based and dynamic anomaly detection. Firstly, the performance metrics of host and network are collected through different methods. In static threshold-based detection phase, the secondary metrics are combined to several group items. When any group item exceeds its threshold, dynamic detection methods are adopt to further detect anomaly. In dynamic detection phase, PCA, joint Gaussian distribution, and Bayesian classification are combined to achieve low cost and efficient anomaly detection. Experimental results in a campus-wide network system show that the proposed dependable monitoring mechanism achieves low false negative (FN) rate and low false positive (FP) rate. The proposed monitoring mechanism outperforms PCA & Bayesian, and grouping detection methods.