An efficient entropy-based network anomaly detection method using MIB

Abstract

With the increasingly widespread application of computer network, it has become a critical task to detect anomalous behaviors in the field of network security. In this paper we develop an entropy-based statistical approach that determines and reports entropy contents for variables in the Management Information Base. The change of the entropy value indicates that a massive network event or an anomaly may occur. We give the analysis on a real data set provided by a large-size network company. Both our theoretical analysis and experimental results demonstrate that the method is effective and efficient for network anomaly detection.