1. Existing system:
There is no well established existing system to prevent the network traffic. Many
approaches have been studied to detect, prevent and mitigate malicious network traffic.
For example, rule-based approaches, such as IDS (intrusion detection system), try to
apply previously established rules against incoming traffic to detect and identify potential
DoS attacks close to the victim’s network. To cope with novel attacks, however, IDS
tools such as Snort [41] require to be updated with the latest rules. This paper looks at the
problem of designing generalized measurement based real-time detection mechanisms.
Measurement-based studies have considered traffic volume [3], [38], [43], number of
flows [40] as potential signals that can be analyzed in order to detect anomalies in
network traffic, while we further treat the traffic headers such as addresses and port
numbers. Work in [43] relies on input data from multiple sources (i.e., all links in a
network), while our work focuses on a single link at a time. Earlier studies have
considerably motivated our current study. Our study builds on this earlier work and
extends the statistical analysis of traffic data further in analyzing other packet header
data, such as addresses and port numbers in real-time. And so we are developing this
statically analysis for detecting the traffic anomalies.
Proposed system:
In this project we are going to detect the anomalies using the following three techniques.
Traffic Analysis at the Source
General mechanism of detector.
Trace.
Traffic Analysis at the Source:
We focus on analyzing the traffic at an egress router. Monitoring traffic at a source
network enables early detection of attacks, to control hijacking of AD (administrative
domain, e.g., campus) machines, and to limit the squandering of resources.
There are two kinds of filtering based on traffic controlling point. Ingress filtering
protects the flow of traffic entering into an internal network under administrative control.
Ingress filtering is typically performed through firewall or IDS rules to control inbound
traffic originated from the public Internet. On the other hand, egress filtering controls the
flow of traffic leaving the administered network. Thus, internal machines are typically the
origin of this outbound traffic in view of an egress filter. As a result, the filtering is
performed at the campus edge. Outbound filtering has been advocated for limiting the
possibility of address spoofing, i.e., to make sure
That source addresses correspond to the designated addresses for the campus. With such
filtering in place, we can focus on destination addresses and port numbers of the outgoing
traffic for analysis purposes.
for more: http://www.seminarprojects.com/Thread-statistical-techniques-for-detecting-
traffic-anomalies-through-packet-header-data--6861?pid=9537#ixzz0jez0Xdfv