Calibrating entropy functions applied to computer networks

Abstract

It has been suggested that the problem of determining the state of a network could be solved by computing entropy functions based on the dynamic connections that are made among the nodes of that network. In this paper we will attempt to calibrate, in a quantitative way, the computation of those entropy functions on simulated data that we believe should resemble real data. Our purpose is to understand how one might use the entropy functions to signal that the state of a network is undergoing a significant change, perhaps due to an attack on the network or an attack emanating from the network. Our results are, we believe, either inconclusive or negative. Specifically, we believe that our simulations suggest either that these entropy functions are not sufficiently indicative of anomalous behavior in a network as to be usable for this purpose or that conversely in order for them to be used to detect anomalous behavior, the underlying "normal" behavior of the network would have to be more stable than we might expect it to be. © Springer-Verlag Berlin Heidelberg 2005.