NABOH system: Gathering intelligence from traffic patterns

Abstract

Network traffic anomalies are important indicators of problematic traffic over a network. Network activity has patterns associated with it depending on the applications running on the local hosts connected to the network. There are traffic parameters into which network traffic of a local host can be divided: bandwidth usage, number of remote hosts that a local host is connecting to and vice versa, and number of ports used by the local host. This thesis develops a system for detecting and profiling network anomalies by analyzing traffic parameters using intelligent computational techniques. The developed system gathers intelligence by examining only the headers of IP packets. Thus the system is referred to as NABOH (Network Anomalies Based On Headers)