Abnormal network flow detection based on application execution patterns from Web of Things (WoT) platforms.

Area of Science:

• Computer Science
• Network Security
• Internet of Things

Background:

• Web of Things (WoT) applications involve complex interactions between web services.
• Identifying abnormal network behaviors in real-time is crucial for application security and reliability.
• Existing methods may struggle with the dynamic nature of WoT application execution patterns.

Purpose of the Study:

• To develop a novel methodology for identifying abnormal behaviors in WoT applications at the network monitor layer.
• To leverage application execution patterns for anomaly detection.
• To improve the effectiveness and efficiency of abnormal behavior detection for system administrators.

Main Methods:

• Execution patterns of WoT applications were profiled as time sequences of web service invocation delays.
• These execution patterns were converted into time sequences of network flows, forming a whitelist of valid behaviors.
• A RETE algorithm was applied at the network monitor layer to compare runtime network flow sequences against the established whitelist.

Main Results:

• The proposed method enables the interpretation of network flow sequences in the context of application logic.
• Empirical evaluation demonstrated that the RETE-based algorithm effectively detects non-conforming network flow instances.
• The RETE-based algorithm showed superior performance in terms of memory usage compared to a baseline algorithm.

Conclusions:

• The developed methodology provides a robust approach for detecting abnormal behaviors in WoT applications.
• Interpreting network flows using application execution patterns enhances the ability of administrators to identify and understand anomalies.
• The RETE algorithm offers an efficient solution for real-time anomaly detection in WoT environments, particularly regarding memory footprint.