Multivariate Correlation Analysis Technique Based on Euclidean Distance Map for Network Traffic Characterization

Abstract. The quality of feature has significant impact on the perfor-mance of detection techniques used for Denial-of-Service (DoS) attack. The features that fail to provide accurate characterization for network traffic records make the techniques suffer from low accuracy in detec-tion. Although researches have been conducted and attempted to over-come this problem, there are some constraints in these works. In this paper, we propose a technique based on Euclidean Distance Map (EDM) for optimal feature extraction. The proposed technique runs analysis on original feature space (first-order statistics) and extracts the multivari-ate correlations between the first-order statistics. The extracted multi-variate correlations, namely second-order statistics, preserve significant discriminative information for accurate characterizations of network traf-fic records, and these multivariate correlations can be the high-quality potential features for DoS attack detection. The effectiveness of the pro-posed technique is evaluated using KDD CUP 99 dataset and experi-mental analysis shows encouraging results