Effectiveness of Hierarchical Heavy Hitter Identification for Intrusion Detection

Network traffics volume is employed extensively for monitoring and identification of traffic patterns. A straight forward approach that maintains the volume for all flows and their aggregations is computationally intractable for today´s high speed networks. Recently, the online hierarchical heavy hitter algorithm has been proposed for efficient change detection in network streams. We implement the hierarchical heavy hitter identification into an intrusion detection system and evaluate its effectiveness using the DARPA intrusion detection evaluation data sets. Our results show that this approach can be particularly valuable for detecting denial of service attacks and port sweeps. We explore the strengths and weakness of the approach for various attack types.