Detection and classification of malicious patterns in network traffic using Benford's law

Computer networks are vital for the secure and fast communication of information in the modern society. To ensure that these networks are functioning properly and safely, it is essential that effective intrusion detection methods are available to accurately detect and classify malicious behaviors. In this paper, we introduce a fast detection method using the Benford's Law to detect and classify certain types of network attacks so to provide an early warning system against potential intrusion by criminals. Our experiments and analysis are performed based on the KDD99 dataset, and the results have shown that the Benford's Law can be very effective in distinguishing between normal and malicious network flows, especially when using multiple digits of the Benford's Law. Moreover, certain types of malicious attack have been detected by our method to contain unique signatures or patterns that can be further used as features for classification so to distinguish them from other types of network attacks. More analysis will be performed based on additional datasets to be presented in our paper.