Anomaly detection methods in wired networks: a survey and taxonomy

Despite the advances reached along the last 20 years, anomaly detection in network behavior is still an immature technology, and the shortage of commercial tools thus corroborates it. Nevertheless, the benefits which could be obtained from a better understanding of the problem itself as well as the improvement of these mechanisms, especially in network security, justify the demand for more research efforts in this direction. This article presents a survey on current anomaly detection methods for network intrusion detection in classical wired environments. After introducing the problem and elucidating its interest, a taxonomy of current solutions is presented. The outlined scheme allows us to systematically classify current detection methods as well as to study the different facets of the problem. The more relevant paradigms are subsequently discussed and illustrated through several case studies of selected systems developed in the field. The problems addressed by each of them as well ...

• Type: Journal
• Year: 2004
• Where: COMCOM
• Authors: Juan M. Estévez-Tapiador, Pedro Garcia-Teodoro, Jesús E. Díaz-Verdejo
• Keywords: Anomaly Detection, COMCOM 2004, Current Anomaly Detection, Detection Methods