Anomalies Detection and Proactive Defence of Routers Based on Multiple Information Learning

Area of Science:

• Computer Science
• Network Security
• Machine Learning

Background:

• Network routers are critical infrastructure, yet their security is challenging due to inaccessibility and heterogeneity.
• Current methods for router anomaly detection, like syslog inspection or packet monitoring, offer limited, single-aspect insights.
• Correlating multiple data sources is essential for comprehensive router security analysis.

Purpose of the Study:

• To develop and evaluate a novel approach for detecting router anomalies and faults using multi-information learning.
• To improve the accuracy and efficiency of router security threat detection compared to existing methods.
• To address the limitations of single-aspect diagnostic approaches in router security.

Main Methods:

• Offline learning to translate user actions into syslogs.
• Constructing log correlations among different network events.
• Anomaly detection via event-to-cluster distance calculation and attack chain prediction for threat assessment.

Main Results:

• The proposed approach achieved 89.6% accuracy in detecting network attacks, surpassing previous methods by 5.1%.
• Demonstrated efficient performance in terms of time and memory usage.
• Exhibited a high detection rate with a low false positive rate in a real-world university network environment.

Conclusions:

• Multi-information learning offers a robust solution for enhancing router security and anomaly detection.
• The developed approach effectively correlates diverse data sources for more accurate threat identification.
• This method provides a significant advancement in network security, particularly for heterogeneous router environments.