Characterising Payload Entropy in Packet Flows—Baseline Entropy Analysis for Network Anomaly Detection

Anthony Kenyon, Lipika Deka () and David Elizondo
Additional contact information
Anthony Kenyon: Hyperscalar Ltd., High Wycombe HP22 4LW, UK
Lipika Deka: School of Computer Science and Informatics, De Montfort University, Leicester LE1 9BH, UK
David Elizondo: School of Computer Science and Informatics, De Montfort University, Leicester LE1 9BH, UK

Future Internet, 2024, vol. 16, issue 12, 1-18

Abstract: The accurate and timely detection of cyber threats is critical to keeping our online economy and data safe. A key technique in early detection is the classification of unusual patterns of network behaviour, often hidden as low-frequency events within complex time-series packet flows. One of the ways in which such anomalies can be detected is to analyse the information entropy of the payload within individual packets, since changes in entropy can often indicate suspicious activity—such as whether session encryption has been compromised, or whether a plaintext channel has been co-opted as a covert channel. To decide whether activity is anomalous, we need to compare real-time entropy values with baseline values, and while the analysis of entropy in packet data is not particularly new, to the best of our knowledge, there are no published baselines for payload entropy across commonly used network services. We offer two contributions: (1) we analyse several large packet datasets to establish baseline payload information entropy values for standard network services, and (2) we present an efficient method for engineering entropy metrics from packet flows from real-time and offline packet data. Such entropy metrics can be included within feature subsets, thus making the feature set richer for subsequent analysis and machine learning applications.

Keywords: entropy; Shannon’s entropy; information gain; anomaly detection; intrusion datasets; deep packet inspection (search for similar items in EconPapers)
JEL-codes: O3 (search for similar items in EconPapers)
Date: 2024
References: View complete reference list from CitEc
Citations:

Downloads: (external link)
https://www.mdpi.com/1999-5903/16/12/470/pdf (application/pdf)
https://www.mdpi.com/1999-5903/16/12/470/ (text/html)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:gam:jftint:v:16:y:2024:i:12:p:470-:d:1544699

Access Statistics for this article

Future Internet is currently edited by Ms. Grace You

More articles in Future Internet from MDPI
Bibliographic data for series maintained by MDPI Indexing Manager ().