Modified batch mean charts for network intrusion detection

Abstract

This paper presents three modified batch mean charts for network intrusion detection. Simulations based on standard control limits and robust control limits are performed considering four factors: cycle, noise, signal, and batch size. The regular batch mean charts are used to eliminate intrinsic 60-second cycles in the sample data. However, the regular batch mean charts monitor the statistics only at the end of each batch, so signal detection is too slow. The proposed modified batch mean charts offer fast detection using actual control limits and robust control limits. The simulation studies show that the modified batch mean charts perform particularly well on large signals, which are the signal types associated with denial of service intrusions.