A Wavelet Entropy-Based Change Point Detection on Network Traffic: A Case Study of Heartbleed Vulnerability

Abstract

This paper investigates network traffic before and after a vulnerability called Heart bleed becomes a public issue around March to May, 2014. To detect anomalies and potential threats due to the vulnerability, a wavelet entropy-based change-point detection method is proposed and compared with three other methods: prediction-based, clustering-based and Fourier transform-based. We show that the proposed wavelet entropy-based method outperforms the others in terms of ease of parameter setting, false alarm and detection accuracy. Using the proposed method and a visualization tool, we have studied Heart bleed vulnerability and successfully captured changes in packet volume and flow.