A Hierarchical Framework for Classifying and Assessing Internet Traffic Anomalies

We present ALARM (HierarchicAL AppRoach for AnoMaly Detection), a hierarchical approach for correlation and prioritization of alerts in distributed networks. The goal is to monitor, classify, correlate and assess a large number of alerts generated at spatially distributed sites on the Internet. The alerts correspond to anomalies and hence potential unknown threats. To facilitate our analysis, we hierarchically decompose the network. At each node of the hierarchy, we use multi-criteria decision making (MCDM), specifically the Electre Tri method, to assign a risk index to each anomaly to assess the threat level of an attack. To the best of our knowledge, this is the first application of MCDM methods to aggregate, correlate and prioritize alerts in distributed networks. The framework of MCDM is well-suited to the growing complexities encountered in alert aggregation and correlation. Each anomaly receives a different risk index for each attack profile that one may want to monitor, such as worms or denials of service. These risk indices are then spatiallyand time-correlated. We demonstrate our framework using historical worm and distributed denial of service (DDoS) data from the Abilene Internet2 Backbone Network. Index Terms network monitoring, network-level security and protection, performance monitors, anomaly detection, multi-criteria decision making