Port Session Communication Analysis Using Density-Based Clustering For Host Anomaly and Risk Activity Analysis

Abstract

Supervision of anomaly activities is very important to do in the network because it could be indicated as malicious activities. Network communication sessions are described in the form of port addressing communication or referred to as port address. In some digital crime events, they are using the port address to do dangerous actions on the network such as DDoS, Probing, R2L, and U2L activities. The grouping model of host activities on the network can utilize clustering theory, namely the neighborhood approach, or refer to as density based. By measuring the proximity of the two activities will be able to group the communication session data distribution from the host and map communication activities based on port access into normal or abnormal activities state. In this research, a new model to analyze port session communication using a density measurement approach to detect anomalous activities was proposed. The result shown that the proposed model can detect a cluster of the status an anomaly, which has more than eighty percent indicates high-risk activity. The proposed model is expected to be able to help network administrators to make decisions or actions from activities that are anomaly and dangerous.