(RT) PAC
Team Members:
Brendan Carell
Tim Thornton
(Real Time) Packet Analysis and Capture
Background
libpcap
- c/c++ packet capture library
- developed by tcpdump group
- will be implemented into a c/c++ application
Network entropy
Statistics
- most used ports
- most active ip addresses
- average packet size
- average traffic amounts
- property distributions
Network anomalies
- normalize entropy
- look for packets atleast n # of standard deviations from normal
- shannon entropy
Entropy Anomaly Detection
A B C D A B C D A B C D
A B C D B B B B B B B B
Maximum uncertainty
Uncertainty begins to approach zero
Goal and Expected Result
Primary
Secondary
- Capture of packets in real time
- Analysis and report of packet statistics for network administration
- Calculation of global and local entropy
- Usage of entropy comparison for anomalous network detection
Execution Plan
Packet Capture Subgoals
- Capture and storage of packets in real time from interface
- Analysis and report of packet statistics
- Calculation of baseline entropy
- Report
Dates
Wed 12, Nov
Wed 19, Nov
Mon 24, Nov
~ Sun 7, Dec
Execution Plan
(Extended Goals)
Anomaly Detection Subgoals
- Calculation of relative window entropy
- Detection of anomalous network usage
Wed 3, Dec
Wed 3, Dec
Fin.
3203 Presentation
By igorii
3203 Presentation
Network Anomaly Detection
