A Survey of Outlier Detection Methods in Network Anomaly Identification <s> B Cognitive packet network based approach <s> Denial of service (DoS) attacks are a serious security threat for Internet based organisations, and effective methods are needed to detect an attack and defend the nodes being attacked in real time. We propose an autonomic approach to DoS defence based on detecting DoS flows, and adaptively dropping attacking packets upstream from the node being attacked using trace-back of the attacking flows. Our approach is based on the Cognitive Packet Network infrastructure which uses smart packets to select paths based on Quality of Service. This approach allows paths being used by a flow (including an attacking flow) to be identified, and also helps legitimate flows to find robust paths during an attack. We evaluate the proposed approach using a mathematical model, as well as using experiments in a laboratory test-bed. We then suggest a more sophisticated defence framework based on authenticity tests as part of the detection mechanism, and on assigning priorities to incoming traffic and rate-limiting it on the basis of the outcome of these tests. <s> BIB001 </s> A Survey of Outlier Detection Methods in Network Anomaly Identification <s> B Cognitive packet network based approach <s> Network worms are malicious self-replicating applications that propagate in a network by infecting node after node. They can cause significant damage by reducing the system performance or totaly disabling nodes, which results into considerable degradation of the quality of service (QoS) that the users experience. The Cognitive Packet Network (CPN) is an adaptive routing protocol that attempts to address the QoS requirements of the network’s users by routing their traffic according to them. Although it is generally very resilient to network changes, it may suffer worse performance during a worm attack. Here we evaluate its performance in such crises and compare it with the Open Shortest Path First (OSPF) routing protocol, the current industry standard and widely used in Internet Protocol networks. Then we improve it by introducing a failure detection element that reduces packet loss and delay during failures. Our experiments were performed in a large networking testbed. <s> BIB002 </s> A Survey of Outlier Detection Methods in Network Anomaly Identification <s> B Cognitive packet network based approach <s> The need for network stability and reliability has led to the growth of autonomic networks that can provide more stable and more reliable communications via on-line measurement, learning and adaptation. A promising architecture is the Cognitive Packet Network (CPN) that rapidly adapts to varying network conditions and user requirements using QoS driven reinforcement learning algorithms that drive the routing control. Contrary to conventional mechanisms, the users rather than the nodes, control the routing by specifying their desired QoS requirements (QoS Goals), such as Minimum Delay, Maximum Bandwidth, Minimum Cost, etc., and the network then routes each user's traffic individually based on their specific needs and on a "glocal" view. In CPN the user has the ability to explore the network for its own needs, and evaluate its own impact on the network as a whole and vice-versa, and then take appropriate decisions. CPN routing has been evaluated extensively under normal operating conditions and has proven to be very adaptive to network changes such as congestion. Here we show how CPN can respond and survive to catastrophic node failures caused by the spread of network worms. This survival is based on two complementary approaches that are run concurrently: one the one hand, each user attempts to concurrently and adaptively avoid paths which are infected, and secondly patching algorithms are continuously run to repair the network. Experiments show that this approach assures the stability of network communications throughout the course of an attack. <s> BIB003 </s> A Survey of Outlier Detection Methods in Network Anomaly Identification <s> B Cognitive packet network based approach <s> As packet networks become extremely large, as their applications and end users become more diverse and extremely numerous, a design based on a single view of how a network should operate becomes harder to justify. Thus each part of the network should be aware of its environment, of its users, of its resources, of its performance, of the energy it is consuming and of the threats that it is facing, and should use this awareness as an operational means to adapt its behaviour accordingly. This tutorial paper sets the stage for these ideas, and shows a simple and practical way forward based one the Cognitive Packet Network routing algorithm and the notion of Self-Aware Networks. <s> BIB004
The cognitive packet network (CPN) architecture uses an adaptive routing protocol that attempts to address the stability and reliability of network services by rerouting their traffic as necessary. Network worms are self-replicating and selfpropagating malicious applications. They can exploit system vulnerabilities of operating systems and spread through networks causing significant damage by reducing system performance. Worms can be considered anomalies in network traffic. Research related to detection of attacks, particularly those by network worms, using CPN is found in BIB003 BIB002   BIB001 . Recent research BIB004  also report on the development of self-aware computer networks (SAN) based on CPN. Such networks are capable of detecting and reacting to intrusions adaptively.