Neue Verfahren zur Anomalie-Erkennung in IP-Netzen.
Roland Kwitt (2005): Neue Verfahren zur Anomalie-Erkennung in IP-Netzen. Fachhochschule Salzburg: Diplomarbeit
This thesis presents a disquisition on dynamic anomaly detection in IP-networks. The first part contains a treatment of a selection of representative approaches in the research field of anomaly detection and provides a summary of the mathematical basics. In the second part of the work, we introduce a new, two-step approach towards anomaly detection, consisting of statistical analysis and machine learning. All concepts are treated step by step on a likewise theoretical and practical basis. Resting upon this new approach, we show encouraging anomaly detection results with respect to a popular intrusion detection data set. Last but not least, we focus on a runtime analysis of the employed algorithms, exemplified by profling results. The work is completed by an outlook on possible enhancements and a summarization of the main outcomes.
