  Statistical characteristics of network traffic have attracted a significant
amount of research for automated network intrusion detection, some of which
looked at applications of natural statistical laws such as Zipf's law,
Benford's law and the Pareto distribution. In this paper, we present the
application of Benford's law to a new network flow metric "flow size
difference", which have not been studied before by other researchers, to build
an unsupervised flow-based intrusion detection system (IDS). The method was
inspired by our observation on a large number of TCP flow datasets where normal
flows tend to follow Benford's law closely but malicious flows tend to deviate
significantly from it. The proposed IDS is unsupervised, so it can be easily
deployed without any training. It has two simple operational parameters with a
clear semantic meaning, allowing the IDS operator to set and adapt their values
intuitively to adjust the overall performance of the IDS. We tested the
proposed IDS on two (one closed and one public) datasets, and proved its
efficiency in terms of AUC (area under the ROC curve). Our work showed the
"flow size difference" has a great potential to improve the performance of any
flow-based network IDSs.
