A review of:

Hierarchical PCA-Based Multivariate Statistical

Network Monitoring for Anomaly Detection
Gabriel Maci-Fernndez (gmacia@ugr.es)
Jos Camacho (josecamacho@ugr.es)
Pedro Garca-Teodoro (pgteodor@ugr.es)
Rafael A. Rodrguez Gmez (rodgom@ugr.es)

Network Information and Security Group (NESG), CITIC

University of Granada

Jornadas Nacionales de Investigacin en Ciberseguridad 2017

Junio, 2017
 MOTIVATION. NETWORK MONITORING

SIEM
Netflow
IDS

Netflow
Firewall Netflow
logs

Hardware
monitor

Syslog
Event logs
Hierarchical PCA-Based Multivariate Statistical Network Monitoring for Anomaly Detection - Gabriel Maci-Fernndez (Univ. Granada) 2
 STARTING POINT. MSNM

MSNM: Multivariate Statistical Network

Monitoring

Camacho, J., Prez-Villegas, A., Garca-Teodoro, P., Maci-Fernndez, G. PCA-based

Multivariate Statistical Network Monitoring for Anomaly Detection. Computers &
Security, 2016, 59: 118-137.

Anukool Lakhina, Mark Crovella, and Christophe Diot. 2004. Diagnosing network-
wide traffic anomalies. SIGCOMM Comput. Commun. Rev. 34, 4 (August 2004), 219-
230.

Hierarchical PCA-Based Multivariate Statistical Network Monitoring for Anomaly Detection - Gabriel Maci-Fernndez (Univ. Granada) 3
 MSNM. COMPLETE PROCESS
New observation

loadings
Features
Observations

scores

X matrix

Detection
residuals +
X = TAPA + EA
Diagnosis

Hierarchical PCA-Based Multivariate Statistical Network Monitoring for Anomaly Detection - Gabriel Maci-Fernndez (Univ. Granada) 4
 MSNM. ANOMALY DETECTION

Detection of anomalies for every observation

by monitoring values of Q-st and D-st

Hierarchical PCA-Based Multivariate Statistical Network Monitoring for Anomaly Detection - Gabriel Maci-Fernndez (Univ. Granada) 5
 MSNM. DIAGNOSING

Diagnosing the problem:

Contribution Plot

Features

Hierarchical PCA-Based Multivariate Statistical Network Monitoring for Anomaly Detection - Gabriel Maci-Fernndez (Univ. Granada) 6
 STANDARD MSNM DETECTION SYSTEM

SIEM

Hierarchical PCA-Based Multivariate Statistical Network Monitoring for Anomaly Detection - Gabriel Maci-Fernndez (Univ. Granada) 7
 OUR PROPOSAL. HIERARCHICAL MSNM

D&Q SIEM

D&Q

D&Q
D&Q

D&Q
D&Q D&Q
D&Q
D&Q
D&Q
D&Q

Hierarchical PCA-Based Multivariate Statistical Network Monitoring for Anomaly Detection - Gabriel Maci-Fernndez (Univ. Granada) 8
 LOAD REDUCTION

We analytically evaluate the load reduction

regarding:
Bandwidth consumption (L sensors):

Computational cost: there is a reduction in

hierarchical approach if the number of nodes
involved in the computation, L, is lower than the
number of variables, M.

Hierarchical PCA-Based Multivariate Statistical Network Monitoring for Anomaly Detection - Gabriel Maci-Fernndez (Univ. Granada) 9
 EXPERIMENTAL VALIDATION

Netflow inspector
Web Servers
(100 machines) 30 client machines 30 client machines

10.0.0.0/24 Border Router 192.168.1.0/24 192.168.2.0/24

BR DMZ webserver
Attacker R1 R2

172.16.0.0/24
R3

192.168.3.0/24

30 client machines

Virtual machines environment with virtual traffic generation

Hierarchical PCA-Based Multivariate Statistical Network Monitoring for Anomaly Detection - Gabriel Maci-Fernndez (Univ. Granada) 10
 DATASET DESCRIPTION

Normal HTTP traffic (25 hours)

Attack traffic (1 hour):
DoS traffic (hping3 tool)
High & low rates
Spoofing
SYN Stealth scans (nmap)
Data exfiltration
Metasploit reverse_tcp on port 4444
6,297,180 connections (Netflow v5 records)

Hierarchical PCA-Based Multivariate Statistical Network Monitoring for Anomaly Detection - Gabriel Maci-Fernndez (Univ. Granada) 11
 METHODOLOGY

Dataset is divided into three subsets:

Calibration (22h): used to build the model
Test (1,5h): used to check the model
Anomaly (1,5h): used to infer detection results

Calibration Test Anomaly

(22h) (1,5h) (1,5h)

25 hours

Hierarchical PCA-Based Multivariate Statistical Network Monitoring for Anomaly Detection - Gabriel Maci-Fernndez (Univ. Granada) 12
 RESULTS
Standard detection
Hierarchical detection

Hierarchical PCA-Based Multivariate Statistical Network Monitoring for Anomaly Detection - Gabriel Maci-Fernndez (Univ. Granada) 13
 CONCLUSIONS

Hierarchical approach allows to solve several

problems in SIEMS:
Considerable load reduction: bandwidth and
processing load
Guarantees privacy
Maintains detection capabilities
Promising results although should be tested
with real environment traffic (ongoing work)

Hierarchical PCA-Based Multivariate Statistical Network Monitoring for Anomaly Detection - Gabriel Maci-Fernndez (Univ. Granada) 14
Thanks for your attention!

This work is partly supported by the Spanish Ministry of

Economy and Competitiveness and FEDER funds
through project TIN2014-60346-R