Collaborative Anomaly-Based Attack Detection

  • Thomas Gamer
  • Michael Scharf
  • Marcus Schöller
Part of the Lecture Notes in Computer Science book series (LNCS, volume 4725)


Today networks suffer from various challenges like distributed denial of service attacks or worms. Multiple different anomaly-based detection systems try to detect and counter such challenges. Anomaly-based systems, however, often show high false negative rates. One reason for this is that detection systems work as single instances that base their decisions on local knowledge only.

In this paper we propose a collaboration of neighboring detection systems that enables receiving systems to search specifically for that attack which might have been missed by using local knowledge only. Once such attack information is received a decision process has to determine if a search for this attack should be started. The design of our system is based on several principles which guide this decision process. Finally, the attack information will be forwarded to the next neighbors increasing the area of collaborating systems.


Detection System Local Knowledge Anomaly Detection Intrusion Detection System Neighbor Discovery 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Hussain, A., Heidemann, J., Papadopoulos, C.: A framework for classifying denial of service attacks-extended. Technical report, USC/Information Sciences Institute (2003)Google Scholar
  2. 2.
    Shannon, C., Moore, D.: The spread of the witty worm. IEEE Security and Privacy 2(4), 46–50 (2004)CrossRefGoogle Scholar
  3. 3.
    Bellovin, S., Leech, M., Taylor, T.: Icmp traceback messages. Internet draft, Internet Engineering Task Force, Work in Progress (2003)Google Scholar
  4. 4.
    Snoeren, A.C.: Hash-based IP traceback. In: SIGCOMM, pp. 3–14 (2001)Google Scholar
  5. 5.
    Mahajan, R., Bellovin, S.M., Floyd, S., Ioannidis, J., Paxson, V., Shenker, S.: Controlling high bandwidth aggregates in the network. SIGCOMM Computer Communication Review 32(3), 62–73 (2002)CrossRefGoogle Scholar
  6. 6.
    Gamer, T.: A system for in-network anomaly detection. In: Kommunikation in Verteilten Systemen, pp. 275–282. Springer, Heidelberg (2007)CrossRefGoogle Scholar
  7. 7.
    Kumar, S.: Classification and Detection of Computer Intrusions. PhD thesis, Purdue University (1995)Google Scholar
  8. 8.
    Roesch, M.: Snort, intrusion detection system (1999),
  9. 9.
    Labib, K., Vemuri, V.R.: NSOM: A tool to detect denial of service attacks using self-organizing maps (2004)Google Scholar
  10. 10.
    Mahoney, M.V.: Network traffic anomaly detection based on packet bytes. In: SAC. Proceedings of the ACM symposium on Applied computing, pp. 346–350. ACM Press, New York (2003)Google Scholar
  11. 11.
    Lakhina, A., Crovella, M., Diot, C.: Diagnosing network-wide traffic anomalies. In: Proceedings of the 2004 conference on Applications, technologies, architectures, and protocols for computer communications (SIGCOMM), pp. 219–230 (2004)Google Scholar
  12. 12.
    Paxson, V.: Bro: a system for detecting network intruders in real-time. Compututer Networks 31(23-24), 2435–2463 (1999)CrossRefGoogle Scholar
  13. 13.
    Wang, K., Stolfo, S.J.: Anomalous payload-based network intrusion detection. In: Jonsson, E., Valdes, A., Almgren, M. (eds.) RAID 2004. LNCS, vol. 3224, pp. 203–222. Springer, Heidelberg (2004)Google Scholar
  14. 14.
    Porras, P.A., Neumann, P.G.: EMERALD: Event monitoring enabling responses to anomalous live disturbances. In: Proc. 20th NIST-NCSC National Information Systems Security Conference, October 1997, pp. 353–365 (1997)Google Scholar
  15. 15.
    Janakiraman, R., Waldvogel, M., Zhang, Q.: Indra: A peer-to-peer approach to network intrusion detection and prevention. In: WETICE. Proceedings of 12th IEEE Workshops on Enabling Technologies, Infrastructure for Collaborative Enterprises, June 2003, pp. 226–231. IEEE Computer Society Press, Los Alamitos (2003)Google Scholar
  16. 16.
    Schnackenberg, D., Holliday, H., Smith, R., Djahandari, K., Sterne, D.: Cooperative intrusion traceback and response architecture (CITRA). In: Proceedings of the DARPA Information Survivability Conference and Exposition (DISCEX), June 2001, pp. 56–68 (2001)Google Scholar
  17. 17.
    Boggs, D.R.: Internet Broadcasting. PhD thesis, Stanford University (1982)Google Scholar
  18. 18.
    Hancock, R., Karagiannis, G., Loughney, J., den Bosch, S.V.: Next steps in signaling (NSIS): Framework. RFC 4080, Internet Engineering Task Force (2005)Google Scholar
  19. 19.
    Bray, T., Paoli, J., Sperberg-McQueen, C.M., Maler, E., Yergeau, F., Cowan, J.: Xml 1.1, 2nd edn. W3C recommendation, W3C (2006)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2007

Authors and Affiliations

  • Thomas Gamer
    • 1
  • Michael Scharf
    • 1
  • Marcus Schöller
    • 2
  1. 1.Institut für Telematik, Universität Karlsruhe (TH)Germany
  2. 2.Computing Department, Lancaster UniversityUK

Personalised recommendations