ISSN: 1985-3157 Vol. 4 No. 1 Jan-June 2010 Statistical Approach for Validating Static Threshold in Fast Atack Detection
61 the process flow of the observation process usi
Figure 4: the process low of the observation process using real traic site
3.3 Experiment Techniques
For the experiment technique, a small local area network LAN has been setup, refer igure 4. The experiment consists of multiple operating
systems such as Windows XP Professional Service Pack 2, Windows Vista and Linux CentOS Version 4.4.
The purpose of the experiment is to identify the normal connection made by each of operating system. By doing this, the normal behavior
of host in transmiting network packet to the destination host within one second time interval is identiied. The result from each of the
operating system will be captured and compared with each other. Another comparison process will be done between the result from the
observation and result from the experiment. The comparison result will
be used to select an appropriate threshold for the fast atack detection.
Figure 5: Experimental setup Figure 5: Experimental setup
ISSN: 1985-3157 Vol. 4 No. 1 Jan-June 2010 Journal of Advanced Manufacturing and Technology
62
3.4 Veriication Process
Ater selecting the appropriate threshold from observation and experiment, the veriication process needs to be done. The purpose of
the veriication process is to identify the valid static threshold for the AVC category and also increase the conidence of the selected static
threshold. In the veriication process the raw network traic data is processed in
the same way as the observation process as depicted in Figure 6. The only diference is that the output from the Time Based Module will
be imported into the Microsot Excel 2003 to construct the Statistical Process Control Chart. The Shewhart Chart has been chosen in this
research to validate the threshold selection. The mean value is selected from the result of the observation technique and experiment technique.
Ater constructing the control chart, the process of validation will be done. The validation was done by inspecting the out of control point
based on the Western Electric Rules. Furthermore, the reason behind the out of control point will also be analyzed. The analyzing process is
done by referring to the network administrator of the site or by technical report produce by certiied bodies. Ater analyzing the out of control
point, then the valid threshold for the AVC category is selected.
Figure 6: Verification process flow
Figure 6: Veriication process low
ISSN: 1985-3157 Vol. 4 No. 1 Jan-June 2010 Statistical Approach for Validating Static Threshold in Fast Atack Detection
63
3.5 Statistical Process Control
