Modified Batch Mean Charts for Network Intrusion Detection

This paper presents a modified batch mean charts for network intrusion detection. Also 3 variants of the modified batch mean chart are provided. Simulation based on the standard control limits and robust control limits are performed with 4 factors: cycle, noise, batch size and signal type. A regular batch mean chart was used to remove the sample data’s inherent 60-second cycles. However, this proved too slow in detecting a signal because the regular batch mean chart only monitored the statistic at the end of the batch. The simulation studies showed that the MBM charts perform especially well with large signals - the type of signal typically associated with a denial of service intrusion. To gain faster results, a modified batch mean (MBM) charts are developed that met this goal. The MBM charts can be applied two ways: by using actual control limits or by using robust control limits.