Detecting anomalies in network traffic using Entropy and Mahalanobis distance

This paper proposes an Entropy-Mahalanobis-based methodology to detect certain anomalies in IP traffic. The balanced estimator II is used to model the normal behavior of two intrinsic traffic features: source and destination IP addresses. Mahalanobis distance allows to describe an ellipse that characterizes the network entropy, which allows to determine whether a given actual traffic-slot is normal or anomalous. Experimental tests were conducted to evaluate the performance detection of portscan and worm attacks deployed in a campus network, showing that the methodology is effective in timely and accurate detection of these attacks.