Characteristics of Network Traffic Flow Anomalies

Proceedings of the ACM SIGCOMM Internet Measurement Workshop

Volumn , Issue , 2001, Pages 69-73

  Barford, Paul ^a   Plonka, David ^b  

^a University of Wisconsin Madison   (United States)

^b UNIVERSITY OF WISCONSIN MADISON   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

CORRELATION METHODS; FOURIER TRANSFORMS; NETWORK PROTOCOLS; ROUTERS; TIME SERIES ANALYSIS; WAVELET TRANSFORMS;

ANOMALY DETECTION; NETWORK TRAFFIC;

TELECOMMUNICATION TRAFFIC;

EID: 0041534324     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/505208.505211     Document Type: Conference Paper

References (19)

1. K. Claffy, G. Polyzos, and H.-W. Braun, "Internet traffic flow profiling," Tech. Rep. TR-CS93-328, University of California San Diego, November 1989.
2. D. Plonka, "Flowscan: A network traffic flow reporting and visualization tool," in Proceedings of the USENIX Fourteenth System Administration Conference LISA XIV, New Orleans, LA, December 2000.
3. Cisco's IOS Netflow Feature, http://www.cisco.com/wrap/public/732/netflow.
4. R. Cáceres, "Measurements of wide-area Internet traffic," Tech. Rep. UCB/CSD 89/550, Computer Science Department, University of California, Berkeley, 1989.
5. V. Paxson, Measurements and Analysis of End-to-End Internet Dynamics, Ph.D. thesis, University of California Berkeley, 1997.
6. V. Paxson and S. Floyd, "Wide-area traffic: The failure of poisson modeling," IEEE/ACM Transactions on Networking, vol. 3(3), pp. 226-244, June 1995.
7. W. Willinger, M. Taqqu, R. Sherman, and D. Wilson, "Self-similarity through high-variability: Statistical analysis of Ethernet LAN traffic at the source level," IEEE/ACM Transactions on Networking, vol. 5, no. 1, pp. 71-86, February 1997.
8. P. Abry and D. Veitch, "Wavelet analysis of long range dependent traffic," IEEE Transactions on Information Theory, vol. 44, no. 1, 1998.
9. K. Claffy, Internet Traffic Characterization, Ph.D. thesis, University of California, San Diego, 1994.
10. I. Katzela and M. Schwartz, "Schemes for fault identificaiton in communicaitons networks," IEEE/ACM Transactions on Networking, vol. 3(6), pp. 753-764, December 1995.
11. F. Feather, D. Siewiorek, and R. Maxion, "Fault detection in an ethernet network using anomaly signature matching," in Proceedings of ACM SIGCOMM '93, San Francisco, CA, September 2000.
12. J. Brutlag, "Aberrant behavior detection in time series for network monitoring," in Proceedings of the USENIX Fourteenth System Administration Conference LISA XIV, New Orleans, LA, December 2000.
13. C. Hood and C. Ji, "Proactive network fault detection," in Proceedings of IEEE INFOCOM '97, Kobe, Japan, April 1997.
14. J. Toelle and O. Niggemann, "Supporting intrusion detection by graph clustering and graph drawing," in Proceedings of Third International Workshop on Recent Advances in Intrusion Detection RAID 2000, Toulouse, France, October 2000.
15. K. Fox, R. Henning, J. Reed, and R. Simonian, "A neural network approach towards intrusion detection," Tech. Rep., Harris Corporation, July 1990.
16. N. Ye, "A markov chain model of temporal behavior for anomaly detection," in Workshop on Information Assurance and Security, West Point, NY, June 2000.
17. D. Moore, G. Voelker, and S. Savage, "Inferring internet denial-of-service activity," in Proceedings of 2001 USENIX Security Symposium, Washington, DC, August 2001.
18. V. Paxson, "Bro: A system for detecting network intruders in real-time," Computer Networks, vol. 31, no. 23-24, pp. 2435-2463, 1999.
19. R. Manajan, S. Bellovin, S. Floyd, V. Paxson, S. Shenker, and J. Ioannidis, "Controlling high bandwidth aggregates in the network," ACIRI Draft paper, February 2001.