In this note, we consider the problem of detecting network portscans through the use of anomaly detection. First, we introduce some static tests for analyzing traffic rates. Then, we make use of two dynamic chi-square tests to detect anomalous packets. Further, we model network traffic as a marked point process and introduce a general portscan model. Simulation results for correct detects and false alarms are presented using this portscan model and the statistical tests.
Nonlinear filtering is an important and effective tool for handling
estimation of signals when observations are incomplete, distorted, and
corrupted. Quite often in real world applications, the signals to be estimated contain unknown parameters which need to be determined.
Herein, we develop and analyze non-recursive and recursive methods, which can deal with combined state and parameter estimation for nonlinear partially-observed stochastic systems. For the non-recursive
method, we obtain the unknown parameters through solving a system of non-singular finite order linear equations. For the recursive method, we generalize the least squares method and develop a particle prediction error identification algorithm so that it can be applied to general nonlinear stochastic systems. We use the branching particle filter to do the signal state estimation and implement simulations for both methods.
Access to the requested content is limited to institutions that have purchased or subscribe to SPIE eBooks.
You are receiving this notice because your organization may not have SPIE eBooks access.*
*Shibboleth/Open Athens users─please
sign in
to access your institution's subscriptions.
To obtain this item, you may purchase the complete book in print or electronic format on
SPIE.org.
INSTITUTIONAL Select your institution to access the SPIE Digital Library.
PERSONAL Sign in with your SPIE account to access your personal subscriptions or to use specific features such as save to my library, sign up for alerts, save searches, etc.