Emphasizing Anomalous Events in Computer Networks for Improved Security

This paper describes an effort to provide a holistic view of network conversation exchanges for the purpose of real-time network monitoring and anomaly detection. We argue that monitoring and anomaly detection are necessary mechanisms for ensuring secure and dependable network computing infrastructure. The model for network traffic exchange is based on a modified Ehrenfest urn model and combines statistical physics and queuing theory to provide macrostate descriptions of complex networked systems when the exact microstate parameters of each element in the system precludes global understanding from first principles such as throughput and utilization. The conversation exchange dynamics model for real-time network monitoring and anomaly detection is formally presented in this context as a systemdriven data reduction model. The model induces a unique real-time visualization capability for network monitoring and detection of anomalous events. This aids in identifying violations of network policy such as network attacks and misconfigurations. This approach has been verified in several environments. Example responses from network attacks simulated in the laboratory including those contained in the DARPA Lincoln Lab IDS test data as well as from operational network traffic are presented. These results suggest that our approach presents a unique perspective on anomalies in computer network traffic. Key-Words: Intrusion detection, network diagnostics, statistical mechanics.