Network Traffic Anomaly Detection and Prevention

This indispensable text/reference presents a comprehensive overview on the detection and prevention of anomalies in computer network traffic, from coverage of the fundamental theoretical concepts to in-depth analysis of systems and methods. Readers will benefit from invaluable practical guidance on how to design an intrusion detection technique and incorporate it into a system, as well as on how to analyze and correlate alerts without prior information.

Topics and features: introduces the essentials of traffic management in high speed networks, detailing types of anomalies, network vulnerabilities, and a taxonomy of network attacks; describes a systematic approach to generating large network intrusion datasets, and reviews existing synthetic, benchmark, and real-life datasets; provides a detailed study of network anomaly detection techniques and systems under six different categories: statistical, classification, knowledge-base, cluster and outlier detection, soft computing, and combination learners; examines alert management and anomaly prevention techniques, including alert preprocessing, alert correlation, and alert post-processing; presents a hands-on approach to developing network traffic monitoring and analysis tools, together with a survey of existing tools; discusses various evaluation criteria and metrics, covering issues of accuracy, performance, completeness, timeliness, reliability, and quality; reviews open issues and challenges in network traffic anomaly detection and prevention.



This informative work is ideal for graduate and advanced undergraduate students interested in network security and privacy, intrusion detection systems, and data mining in security. Researchers and practitioners specializing in network security will also find the book to be a useful reference.

Acest indispensabil text / referinta prezinta o imagine de ansamblu cuprinzatoare asupra detectarii si prevenirii anomaliilor in traficul retelei de calculatoare, de la acoperirea conceptelor teoretice fundamentale pana la analiza aprofundata a sistemelor si metodelor. Cititorii vor beneficia de indrumari practice nepretuite despre cum sa proiecteze o tehnica de detectare a intruziunilor si sa o incorporeze intr-un sistem, precum si despre cum sa analizeze si sa coreleze alertele fara informatii prealabile. , detaliind tipurile de anomalii, vulnerabilitatile retelei si o taxonomie a atacurilor de retea; descrie o abordare sistematica pentru generarea unor seturi de date de intruziune in retea si analizeaza seturile de date sintetice, de referinta si din viata reala existente; ofera un studiu detaliat al tehnicilor si sistemelor de detectare a anomaliilor de retea in sase categorii diferite: statistici, clasificare, baze de cunostinte, detectare cluster si valori anterioare, informatica simpla si cursanti combinati; examineaza tehnicile de gestionare a alertelor si de prevenire a anomaliilor, inclusiv preprocesarea alertelor, corelarea alertelor si postprocesarea alertelor; prezinta o abordare practica pentru dezvoltarea instrumentelor de monitorizare si analiza a traficului in retea, impreuna cu o ancheta a instrumentelor existente; discuta diverse criterii si valori de evaluare, acoperind probleme de acuratete, performanta, completitudine, actualitate, fiabilitate si calitate; trece in revista problemele deschise si provocarile in detectarea si prevenirea anomaliilor traficului in retea. Aceasta lucrare informativa este ideala pentru studentii absolventi si avansati interesati de securitatea si confidentialitatea retelei, sistemele de detectare a intruziunilor si extragerea datelor in securitate.