Abstract

The Method of Entropy Spaces is based on constructing a three-dimensional space of network traffic at packet flow level. Each point in that space is a three-dimensional entropy value of the clusters of flows observed during a time slot. The selection of features for point clouds data is performed using Pattern Recognition (PR) techniques such as Principal Component Analysis (PCA) and Kernel Density Estimation (KDE). The typical traffic of the network is a model formed by a Gaussian Mixture (GM) and a Generalized Extreme Distribution (GEV) that defines the behavior of the selected features. These models, when integrated into an Anomaly-Based Intrusion Detection System (A-NIDS) were effective in detecting actual attacks carried out in a Local Area Network (LAN).