NADA - Network Anomaly Detection Algorithm

This paper deals with a new iterative Network Anomaly Detection Algorithm – NADA, which accomplishes the detection, classification and identification of traffic anomalies. NADA fully provides all information required limiting the extent of anomalies by locating them in time, by classifying them, and identifying their features as, for instance, the source and destination addresses and ports involved. To reach its goal, NADA uses a generic multifeatured algorithm executed at different time scales and at different levels of IP aggregation. Besides that, the NADA approach contributes to the definition of a set of traffic anomaly behavior-based signatures. The use of these signatures makes NADA suitable and efficient to use in a monitoring environment.

• Type: Conference
• Year: 2007
• Where: DSOM
• Authors: Silvia Farraposo, Philippe Owezarski, Edmundo Monteiro
• Keywords: DSOM 2007, NADA Approach, Network Anomaly Detection, Signatures Makes Nada