Rating the Significance of Detected Network Events

Mungro, Meenakshee

Rating the Significance of Detected Network Events

dc.contributor.advisor	Nelson, Richard
dc.contributor.author	Mungro, Meenakshee
dc.date.accessioned	2014-09-08T04:10:28Z
dc.date.available	2014-09-08T04:10:28Z
dc.date.issued	2014
dc.date.updated	2014-07-13T22:26:19Z
dc.description.abstract	Existing anomaly detection systems do not reliably produce accurate severity ratings for detected network events, which results in network operators wasting a large amount of time and effort in investigating false alarms. This project investigates the use of data fusion to combine evidence from multiple anomaly detection methods to produce a consistent and accurate representation of the severity of a network event. Four new detection methods were added to Netevmon, a network anomaly detection framework, and ground truth was collected from a latency training dataset to calculate the set of probabilities required for each of the five data fusion methods chosen for testing. The evaluation was performed against a second test dataset containing manually assigned severity scores for each event and the significance ratings produced by the fusion methods were compared against the assigned severity score to determine the accuracy of each data fusion method. The results of the evaluation showed that none of the data fusion methods achieved a desirable level of accuracy for practical deployment. However, Dempster-Shafer was the most promising of the fusion methods investigated due to correctly classifying more significant events than the other methods, albeit with a slightly higher false alarm rate. We conclude by suggesting some possible options for improving the accuracy of Dempster-Shafer that could be investigated as part of future work.
dc.format.mimetype	application/pdf
dc.identifier.citation	Mungro, M. (2014). Rating the Significance of Detected Network Events (Thesis, Master of Science (MSc)). University of Waikato, Hamilton, New Zealand. Retrieved from https://hdl.handle.net/10289/8808	en
dc.identifier.uri	https://hdl.handle.net/10289/8808
dc.language.iso	en
dc.publisher	University of Waikato
dc.rights	All items in Research Commons are provided for private study and research purposes and are protected by copyright with all rights reserved unless otherwise indicated.
dc.subject	Data fusion
dc.subject	Anomaly detection
dc.subject	Network latency
dc.title	Rating the Significance of Detected Network Events
dc.type	Thesis
pubs.place-of-publication	Hamilton, New Zealand	en_NZ
thesis.degree.discipline	Computer Science
thesis.degree.grantor	University of Waikato
thesis.degree.level	Masters
thesis.degree.name	Master of Science (MSc)