Nowadays, countless network attacks are known, exploiting the vulnerability
of network protocols and Internet topology. In our work, we tackle the problem
of anomaly detection in computer communication networks from the standpoint
of network analysis. We model the interactions between different network
protocols as dynamics in a graph. We demonstrate that the traditional approach
to constructing a graph is inadequate and fails to capture correlations in
paths of length larger than two. We devise an anomaly detection procedure
based on higher-order dependencies and show that it correctly identifies
an UDP flood attack. We give insights into how computer communication protocols
interact and what are the most common traffic patterns in the Internet.
|
