Detecting stealthy attacks: Efficient monitoring of suspicious activities on computer networks

It may take weeks or months before a stealthy attack is detected. As networks scale up in size and speed, monitoring for such attempts is increasingly a challenge; collection and inspection of individual packets is difficult as the volume and the rate of traffic rise. This paper presents an efficient method to overcome such a challenge. Data reduction has become an integral part of passive network monitoring, which could be motivated as long as it preserves the required level of precision. This paper examines the feasibility of employing traffic sampling together with a simple, but a systematic, data fusion technique for monitoring; and whether the design of the network affects on non-sampling error. Proposed approach is capable of monitoring for stealthy suspicious activities using 10%20% size sampling rates without degrading the quality of detections.