Time series analysis for ARP anomaly detection: A combinatorial network-based approach using multivariate and mean-variance algorithms

Abstract

This paper presents a novel network-based ARP anomaly detection technique. The proposed approach applies a combinatorial algorithm composed of multivariate and mean-variance algorithms. The paper main objective is to construct a statistical ARP anomaly detection system capable of classifying the ensemble network ARP traffic as normal or abnormal. For this purpose time series data of normal purred ARP traffic from the ensemble network are analyzed and some statistical parameters are extracted. The observed time series data of ARP traffic parameters are compared by the normal parameters. Any deviation from the normal model is intended to be abnormal. The proposed technique is novel and this paper is the first publication that introduces a high accurate and performance Network-based ARP anomaly detection technique. © 2008 Springer-Verlag.