Robust statistics is a branch of statistics which includes statistical methods capable of dealing adequately with the presence of outliers. In this paper, we propose an anomaly detection method that combines a feature selection algorithm and an outlier detection method, which makes extensive use of robust statistics. Feature selection is based on a mutual information metric for which we have developed a robust estimator; it also includes a novel and automatic procedure for determining the number of relevant features. Outlier detection is based on robust Principal Component Analysis (PCA) which, opposite to classical PCA, is not sensitive to outliers and precludes the necessity of training using a reliably labeled dataset, a strong advantage from the operational point of view. To evaluate our method we designed a network scenario capable of producing a perfect ground-truth under real (but controlled) traffic conditions. Results show the significant improvements of our method over the corresponding classical ones. Moreover, despite being a largely overlooked issue in the context of anomaly detection, feature selection is found to be an important preprocessing step, allowing adaption to different network conditions and inducing significant performance gains.

A concerted fight against botnets is needed in order to avoid them from becoming a serious threat to global security in the forthcoming years. Zombie detection is currently performed at the host and/or network levels, but these options have important drawbacks: antivirus, firewalls and anti-spyware are not effective against this threat because they are not able to detect hosts that are compromised via new or target specific malicious software and were not designed to protect the network from external attacks or vulnerabilities that are already present inside the local area network. To overcome these limitations, we propose a new botnet detection approach based on the identification of traffic patterns: since each network application, whether it is licit or illicit, has a characteristic traffic pattern that can uniquely identify it, the detection framework will rely on an Artificial Neural Network to identify the licit and illicit patterns. After the identification phase, the system will generate alarms to the system administrator, that can trigger the most appropriate security actions, like blocking the corresponding IP addresses, putting them under a deeper surveillance or acting over some suspicious network segment. A general detection framework was developed in order to incorporate the detection methodology itself, as well as the data collection and storage modules and all the necessary management functions. Some performance tests were already carried out on the proposed system and the results obtained show that the system is stable and fast and the detection approach is efficient, since it provides high detection rates with low computational overhead.

One of the most important threats to personal and corporate Internet security is the proliferation of zombie PCs operating as an organized network. Zombie detection is currently performed at the host level and/or network level, but these options have some important drawbacks: antivirus, anti-spyware and personal firewalls are ineffective in the detection of hosts that are compromised via new or target-specific malicious software, while network firewalls and intrusion detection systems were developed to protect the network from external attacks but they were not designed to detect and protect against vulnerabilities that are already present inside the local area network. This paper presents a new approach, based on neural networks, that is able to detect zombie PCs based on the historical traffic profiles presented by "licit" and "illicit" network applications. The evaluation of the proposed methodology relies on traffic traces obtained in a controlled environment and composed by licit traffic measured from normal activity of network applications and malicious traffic synthetically generated using the subseven backdoor. The results obtained show that the proposed methodology is able to achieve good identification results, being at the same time computationally efficient and easy to deploy in real network scenarios.