Model-Based Anomaly Detection on Network Services

The key hypothesis to anomaly detection assumes anomalous behaviors are suspicious from a normality point of view. This work provides a new perspective, network service, to model network activity for detecting anomalies. Past models often suffer from lacking of model normality verification, only including particular behavior aspect, and focusing on individual model. To confront them, we propose a framework based on the perspective of multiple network service models. For normality verification, we show how to construct underlying protocol models by static and dynamic approach to guarantee the usability. For the latter two problems, we show how to construct composite service model with protocol interaction and correlation. Classes of attacks, such as worm and botnet, illustrate that our composite model detects the symptom of attack that individual ones cannot. This work provides a promising perspective from network service and a new construction method for service modeling.