Host-based packet header anomaly detection using statistical analysis

The exposure of network packets to frequent cyber attacks has increased the need for designing statistical-based anomaly detection recently. Conceptually, the statistical based anomaly detection attracts researcher's attention, but technically, the low attack detection rates remains an open challenges. We propose a Host-based Packet Header Anomaly Detector (HbPHAD) model that is capable of identifying suspicious packet header behaviour based on statistical analysis. We compute scoring function using Relative Percentage Ratio (RPR) in calculating normal scores, integrate Linear Regression Analysis (LRA) to differentiate the behaviour of the packets and Cohen's-d (effect size) measurement to pre-define the best threshold. HbPHAD is an effective solution for statistical-hased anomaly detection 111 identifying suspicious behaviour correctly. The experiment demonstrates that HbPHAD IS effective in accurately detecting suspicious packet at above 99% as an attack detection rate.