Time series analysis based models for network abnormal traffic detection

Intrusion detection and monitoring systems produce hundreds or even thousands of events every day. Unfortunately, most of these events are false positives, or irrelevant and can be considered as background noise, which makes their correlation, analysis and investigation very complicated and resource consuming. This paper presents modeling of background noise using the Non-Stationary time series analysis with lag smoothing Kalman filter then introduces a second technique applying a multi-layered perceptron neural network with back propagation learning to model and correlate the background noise. DARPA Dataset is used to analyze and compare both techniques and finally a verification experiment is conducted using a gathered dataset from a real network environment. Comparisons show that the proposed neural model outperforms the non-stationary time series model.