Security Evaluation of Hosts Based on Network Traffic

Malicious behavior will lead to abnormal network traffic patterns. This paper presents a network traffic based method to evaluate the security situation of hosts. A group of variables that can reflect the network traffic feature in a fixed time window are selected as the evaluation metrics. Based on the large samples, we report on a preliminary proof-of-concept approach, that´s logistic regression analysis, to evaluate the probability of host that run into insecure status. The evaluation results are regarded as the normalized abnormality value to evaluate the network traffic of hosts. Experiments and testing show that this method can reasonably evaluate the host network abnormal traffic.