The Analysis of Traffic of IP Packets using CGH. Self Organizing Map

Size: px

Start display at page:

Download "The Analysis of Traffic of IP Packets using CGH. Self Organizing Map"

Christina Blake
5 years ago
Views:

1 2015 International Conference on Computational Science and Computational Intelligence The Analysis of Traffic of IP Packets using CGH Self Organizing Maps Hiroshi Dozono Department of Advanced Fusion Saga University 1-Honjyo Saga JAPAN Nozomu Okada FUJITSU GENERAL JAPAN Abstract Recently, many packet analysis methods are proposed for the threat of the increasing malware. In this research, the method for the analysis of the IP packet based on SOM(Self- Organizing Map) using the frequency of appearance of IPpackets as input vectors is proposed. The performance of this method is examined by the experiment of detecting the packets generated by emulating malware behaviors. I. INTRODUCTION As the growth of communication networks, the security issues concerning network are increasing. As a attacking technique to the server, DOS/DDOS attacks are often used. Under these attacks, a large number of packets are sent to the server to increase the load of the server, and to disturb the normal operation. To defend the server from such attacks, the analysis of the packet traffic is effective. We proposed a method for analyzing the packet traffics using Self Organizing Map(SOM)s[1]. The packet data can be captured using WinPcap, which is the packet driver for WINDOWS OS. We proposed a visualization method of packet traffics using SOM and conducted some experiments for detecting the attacks. As the previous work using SOM for network traffic analysis, in [2] the large amount of logs from IDS systems were analyzed and the information of each packet was learned using SOM. In [3], the occurrence rate of the IP address in the list of IP address was analyzed by using SOM. With expanding the scope to machine learning, many machine learning method including neural networks are applied to the detection of abnormal traffics originated from malware using the KDD CUP 99 data as sample set[4]. In this paper, we propose a method for analyzing packet traffics using Computer Generated Hologram(CGH) SOM[5] as a method for analyzing big data. In the previous study mentioned before, we propose a method using conventional SOM and Pareto learning SOM. On the other hand, we proposed CGH SOM for clustering 2 dimensional images and 3 dimensional objects. In this paper, CGH SOM is applied to the analysis of packet traffic to extract the feature of the packet traffics effectively. Additionally, we conducted the experiments of detecting unauthorized traffic using unsupervised learning considering the situation of unknown attacks. II. SELF ORGANIZING MAP(SOM) Self-Organizing Map (SOM)[2] is the model of the neurologic function of the cerebral cortex developed by T.Kohonen. As the class of neural networks, SOM is the feedforward type of two hierarchical without the interlayer using algorithms of unsupervised learning. SOM converts a nonlinear and statistics relations that exist between higher dimension data into the image with a simple geometrical relation. They can usually be used to make a higher dimension space visible because it is displayed as the lattice of the neuron of two dimensions. Moreover, it becomes easy to be able to visualize higher dimension information because it is possible to cluster without the preliminary knowledge, and to understand the relations among these multidimensional data intuitively for human. SOM is basically a Fig. 1. Self Organizing Map network in the double-layered structure in the input layer and the competitive layer as shown in Fig.1. However, there are not connections between neurons in the same layer. The first layer is input layer x of n dimension, and the second layer is called a competitive layer, and is generally two dimension array for visualizing output data. It is assumed that it has the neuron that input data is given by n-dimensional real number vector x =(x 1,x 2,..., x n ) and two dimensions SOM were arranged on the grid point of m m(= M)piece. Input data x is presented to all neurons. The neuron located in (j, i)in two dimension lattice array has w j,i = (w 1 j,i,w2 j,i,..., wn j,i ) /15 $ IEEE DOI /CSCI

2 weight vectors which are tunable corresponding to the input vectors. This w j,i is called as reference vector. The algorithm can be divided into two phases in a competitive phase and the cooperative phase. First of all, the neuron of the closest,in a word, the winner neuron, is selected at a competitive phase. Next, the winner s weight are adjusted at the cooperation phase as well as the lattice near the winner. TABLE II SETTING OF THE EXPERIMENT Map size Number of packets Group size 500 Overlap of group 200 Protocol TCP III. PACKET ANALYSIS USING SOM A. Packet capture In this experiments, the packet data which is captured in our laboratory is used. Packet data is captured by the program which uses WinPcap library which is build for WINDOWS OS. The packets are captured in promiscuous mode. However, the unauthorized packets are already captured by 3 firewalls which is located between the laboratory and external internet. Thus we can get only authorized packets. B. Packet analysis using frequencies It needs large computational costs to analyze each packet independently using SOM because the number of packets is very large. And Dos and DDos attacks are collective behavior of the packets. From these reasons, the statistical information of the group of the packets is used. As the statistical information, the frequency of the code in the group of packets is used. Frequencies of the specific data are often used to visualize the big data by SOM[6]. Table I shows the contents of the input vector which is composed of the frequencies of the elements in the packet. For each 8[bit](1 byte) of 32[bit] IP address, TABLE I CONTENTS OF INPUT VECTOR Packet element dimension Source IP adress Destination IP address Source port number 20 Destination port number 20 Packet length 7 Payload 256 the frequency of each code is counted. For example, if the source IP address is , 133th of 1st 256 elements, 49th of 2nd 256 elements, 30th of 3rd 256 elements and 1st of 4th 256 elements are counted up respectively. As for port number, the frequencies of 20 port numbers which are frequently used by malware are counted. Packet length is classified to 7 classes, and the frequency of each class is counted. For payload data, the frequency of each code is counted. C. Mapping the traffic of authorized packets At first, the experimental result of mapping the traffic of the captured packets which were filtered by firewalls. The setting of the experiment is shown in Table 2. Fig.2 shows the map organized by SOM. Each dot represents a group of packets, and the shade of the color denotes the sequential order of the group. The color is continuously changing on the map, and it Fig. 2. Mapping of the authorized packet means that authorized traffic of the packets are continuously arranged on the map. D. Experiments of detection of the traffic including unauthorized packets Next, Experiments of detection of the traffic including unauthorized packets is conducted. As mentioned before, the unauthorized packets cannot reach to our laboratory, the pseudo unauthorized packets which simulate Dos and DDos attacks are used in these experiments. Dos packets and DDos packets are generated with setting the source IP addresses as fixed number and random number respectively. After initial learning using authorized packets, the groups of packets including unauthorized packets are given as input of SOM. The groups whose mapped distance from previous group of authorized packets are larger than 2σ are detected as the group including unauthorized packet, where σ is standard deviation of the distance before the group is processed. During the attacks, 80% of the packets are unauthorized packets, and 3 experiments are conducted for each case. For each cases, 5 experiments are conducted, and average of the experiments is presented. Table 3 and Table 4 shows the results for simulated Dos and DDos attacks with changing overlap size of the group respectively. The results vary with the overlap size, TABLE III EXPERIMENTAL RESULTS FOR SIMULATED DOS ATTACKS Overlap size Specificity Sensitivity and specificity is too low for almost cases. To improve the accuracy, CGH SOM is applied

3 TABLE IV EXPERIMENTAL RESULTS FOR SIMULATED DDOS ATTACKS Overlap size Specificity Sensitivity IV. COMPUTER GENERATED HOLOGRAM (CGH) SOM CGH-SOM is the composition of SOM and matched filtering using CGH, and can be applied to cluster the images data and 3D objects. Especially, matched filtering is powerful for the matching of 2 dimensional images including shifts. 1) CGH: Hologram is the record of the interference patterns of reflected beam of the object and reference beam. Assuming that the reflected beam of the object and reference beam are O and R respectively, and that the transmittance of the dry plate is in proportion to the amplitude of the exposure beam, the distribution of the transmittance is given as follows. O 2 + R 2 (1) CGH processes the optical operation of hologram in computer. The hologram is calculated based on the spatial information of the object as shown in Fig.3. In Fig.3, Taking the amplitude of Fig. 3. Calculation of CGH the reference beam R and object beam O as A 1 and A 2, and the cosine of the axis of the coordinate (xyz) as cosα x1,cosα y1 and cosα z1, R and O at (x, y, z) =(x 0,y 0, 0) is given as follows. R(x 0,y 0, 0) = A 1 exp( ik(x 0 cosα x1 + y 0 cosα y1 ))(2) O(x 0,y 0, 0) = A 1 exp( ikz 2 ik ((x 0 x 2 ) 2 z 2 2z 2 (3) +(y 0 y 2 ) 2 )) (4) where k is wave number. From these equations, the interference pattern I is given as follows. I(x 0,y 0, 0) = R + O 2 (5) = A A2 2 z 2 2 This equation represents CGH. (6) +2 A 1A 2 z 2 (7) cos(k(d (x 0 cosα x1 + y 0 cosα y1 )))(8) 2) Matched filtering: Matched filtering is a method for pattern recognition using hologram, and the correlation between 2 images can be calculated as numerical value. For images, the Fourier transform hologram is generally used as the filter. Assume that the object beam used to generate hologram and the object beam of the input image for matching are O 1 and O 2 respectively. As the distribution of the transmittance is R + O 1 2, the distribution of the output beam with projecting the object beam O 2 is given as follows. R + O 1 2 O 2 (9) =( R 2 + O 1 2 ) O 2 + R O 1 O 2 + R O1 O 2 (10) where denotes complex conjugate. The 3rd term of this equation that represent reference beam component becomes O 1 2 R, if the image that is used to generate hologram and input image is same. Because the reference component is plane wave, the peak pattern called as correlation spot is detected with transmitting through lens, and the amplitude of the peak represents the similarity between the images. All of the optical process is simulated in computer in CGH, and the lens is simulated by Fourier transform in CGH. 3) The algorithm of CGH-SOM: CGH-SOM is the self organizing map which is composed of the units using CGH as memories. The learning algorithm is almost the same as that of conventional SOM with batch updates. CGH-SOM Algorithm Step1 : Preprocessing of images For each image Data D i, calculate the Fourier transform hologram F i. Step 2 : Initialization of the map For each unit U ij on the map, generate the initial hologram h ij randomly. Step 3: Matching Match the holograms on the map and Fourier transform hologram of image data. For each h ij, for each F k, generate the matching image F ( h ij F k ), and calculate P max ij k which is the maximum amplitude of the correlation spot respectively. Step 4: Finding winner For each image D k, find the winner unit W ij k using the matching results P max ij k. Step 5: Updating the units For each winner W ij k, update the hologram h ij and its neighbors using the following equation. h ij = h ij + ηfn(d)(f k hij) (11) where η is learning coefficient and fn(d) is the neighboring function. Repeat Step 3 - Step 5 by decreasing the size of neighbors and learning coefficient in pre-defined iterations In step 1, the Fourier transform of the images are computed before applied to SOM because the computational costs are very large. In step 3, the input object data is matched with the holograms on the map based on the matching method of

hologram processing. In step 4 and step 5,standard equation of SOM can be applied for updating holograms on the map, because the holograms can be superposed by simply summing the holograms. Fig.

Input image converted from a packets A. Mapping the traffic of authorized packets Fig.5 shows the experimental result of mapping the groups of authorized packets using CGH-SOM. As same as the Fig. 4.

SOM uses simple Euclidian distance for matching. CGH SOM uses matched filtering of CGH for matching, and it is sensitive to abnormal data. Additionally, 2-stage SOM is applied to payload data.

4 hologram processing. In step 4 and step 5,standard equation of SOM can be applied for updating holograms on the map, because the holograms can be superposed by simply summing the holograms. Fig.4 shows an example of the map organized by CGH- SOM. The bitmap patterns of the character BCDEFIOQT are used as input data. As shown in Fig.4, similar patterns are arranged closely on the map. Fig. 5. Input image converted from a packets A. Mapping the traffic of authorized packets Fig.5 shows the experimental result of mapping the groups of authorized packets using CGH-SOM. As same as the Fig. 4. Example of CGH SOM V. PACKET ANALYSIS USING CGH SOM In section 3, the experimental results using SOM are mentioned. However, the accuracy is not significant. SOM uses simple Euclidian distance for matching. CGH SOM uses matched filtering of CGH for matching, and it is sensitive to abnormal data. Additionally, 2-stage SOM is applied to payload data. Payload data is clustered in the 1st stage SOM, and the resulting map of 1st stage is clustered in 2nd stage CGH-SOM. Compared with using the conventional vectorial SOM in 2nd stage, CGH-SOM is considered to be able to extract the features which are organized by 1st stage SOM because it can process 2 dimensional data. 4) Composition of input image: To apply CGH-SOM, the input data is needed to be converted to image data. in the previous experiments, the group of packets is converted to a input vector. On the other hand, each packet is converted to the input data of CGH-SOM in the following experiments. Fig.5 shows the input image which is converted from a packet. The image size is 16 16, and each pixel is 256 grayscale. The 8 bytes binary values of sender and destination IP addresses are stored in 6 pixels of column. The size of the column represents the weight of the data. Port number and header information which is comprised of header length, TTL and packet length are given 2 6 pixels and 4 6 pixels respectively. The payload data is the frequencies of 6[byte] codes in the payload of each packets which were organized in units by 1st stage SOM. 1st stage SOM is organized by using the payload data of normal traffic packets beforehand. Fig. 6. Mapping of the authorized packet using CGH-SOM mapping result of conventional SOM using groups of data as input vectors, the packets are arranged continuously on the map. B. Experiments of detection of the traffic including unauthorized packets Next, experiments of detection of the traffic including unauthorized packets are conducted. The method of this experiment is almost the same as those using conventional SOM except CGH-SOM uses each packet as input data. Table 5 and Table 6 show the results for Dos and DDos attacks respectively. The sizes of group are taken 150 and 50 for Dos and TABLE V EXPERIMENTAL RESULTS FOR SIMULATED DOS ATTACKS Rate of the unauthorized packets Specificity Sensitivity DDos attacks respectively, which show the best results in

5 TABLE VI EXPERIMENTAL RESULTS FOR SIMULATED DDOS ATTACKS Rate of the unauthorized packets Specificity Sensitivity the previous experiments. As for Dos attacks, the accuracy is improved for the same rate(0.8) of unauthorized packets and even for the smaller rates of unauthorized packets. As for DDos attacks, the accuracy becomes worse for all cases. VI. CONCLUSION In this paper, the methods for analyzing packet traffic using SOM and CGH-SOM are proposed. Using the frequencies of codes in the header and payload ss the statistical information of the group of packets and the input data converted from each packet, the traffic of packets is visualized as the continuous flow on the map by SOM and CGH-SOM respectively. The experiments of detecting pseudo Dos and DDos attacks are conducted, and CGH-SOM can improve the accuracy for Dos attack, however conventional SOM is still superior to detect DDos attacks. As for further works, the comparison with other method should be conducted, and the accuracy of detection should be improved much more to use this method practically. ACKNOWLEDGMENT This work was supported by JSPS KAKENHI Grant Number REFERENCES [1] H. Dozono and T. Kabashima,et.al. Analysis of Packet Traffics and Detection of Abnormal Traffics Using Pareto Learning Self Organizing Maps, ICONIP 2010, Part II, LNCS 6444, pp , Springer, [2] K. Ohkouchi and K. Rikitake,et.al. A Study on Network Incident Analysis Using Self Organizing Maps, Proceedings of the 2006 Symposium on Cryptography and Information Security, [3] K. Kanenishi and K. Togawa,et.al. Aberrant Detection from Behavior of Campus Network Traffic, Journal of Academic Computing and Networking (13), 74?83, 2009 [4] Mahbod Tavallaee, et.al,. A Detailed Analysis of the KDD CUP 99 Data Set, Proceedings of the 2009 IEEE Symposium on Computational Intelligence in Security and Defense Applications, 2009 [5] H. Dozono and A. Tanaka,et.al. Mapping of the 3D Objects Using Computer Generated Hologram SOM, Advances in Self-Organizing Maps (WSOM2011), , Springer, 2011 [6] T. Abe and T. Ikemura,et.al. A Novel Bioinfor- matics Strategy for Phylogenetic Study of Genomic sequence Fragments: Self Organizing Map (SOM) of Oligonu- cleotide Frequencies, Proceedings of 5th Workshop on Self Organizing Maps, ,

Visualization of the Packet Flows using Self Organizing Maps

Visualization of the Packet Flows using Self Organizing Maps HIROSHI DOZONO Saga University Faculty of Science and Engineering 1 Honjyo Saga Saga JAPAN hiro@dna.ec.saga-u.ac.jp TAKERU KABASHIMA Saga University