Anomaly detection in IP networks

IEEE Transactions on Signal Processing

Volumn 51, Issue 8, 2003, Pages 2191-2204

  Thottan, Marina ^a   Ji, Chuanyi ^b  

^a LUCENT TECHNOLOGIES   (United States)

^b GEORGIA INSTITUTE OF TECHNOLOGY   (United States)

Author keywords

Adaptive signal processing; Autoregressive processes; Eigenvalues and eigenfunctions; Network performance; Network reliability

Indexed keywords

ADAPTIVE ALGORITHMS; ARTIFICIAL INTELLIGENCE; EIGENVALUES AND EIGENFUNCTIONS; NETWORK PROTOCOLS; SIGNAL PROCESSING; STATISTICAL METHODS;

ADAPTIVE SIGNAL PROCESSING;

TELECOMMUNICATION NETWORKS;

EID: 0043166339     PISSN: 1053587X     EISSN: None     Source Type: Journal    
DOI: 10.1109/TSP.2003.814797     Document Type: Article

References (46)

1. W. E. Leland, M. S. Taqqu, W. Willinger, and D. V. Wilson, "On the self-similar nature of ethernet traffic (extended version)," IEEE/ACM Trans. Networking, vol. 2, pp. 1-15, Feb. 1994.
2. J. L. Vehel, E. Lutton, and C. Tricot, Fractals in Engineering: From Theory to Industrial Applications. New York: Springer-Verlag, 1997, pp. 185-202.
3. N. G. Duffield, F. L. Presti, V. Paxson, and D. Towsley, "Inferring link loss using striped unicast probes," in Proc. IEEE INFOCOM, 2001.
4. M. Coates, A. Hero, R. Nowak, and B. Yu, "Internet tomography," IEEE Signal Processing Mag., vol. 19, pp. 47-65, May 2002.
5. M. Thottan, "Fault detection in ip networks," Ph.D. dissertation, Rensselaer Polytech. Inst., Troy, NY, 2000. Under patent with RPI.
6. H. Wang, D. Zhang, and K. G. Shin, "Detecting syn flooding attacks," in Proc. IEEE INFOCOM, 2002.
7. O. Akashi, T. Sugawara, K. Murakami, M. Maruyama, and N. Takahashi, "Multiagent-based cooperative inter-as diagnosis in encore," in Proc. NOMS, 2000.
8. M. Basseville and I. Nikiforov, Detection of Abrupt Changes, Theory and Application. Englewood Cliffs: Prentice-Hall, 1993.
9. T. Ye, S. Kalyanaraman, D. Harrison, B. Sikdar, B. Mo, H. T. Kaur, K. Vastola, and B. Szymanski, "Network management and control using collaborative on-line simulation," in Proc. CNDSMS, 2000.
10. I. Norros, "A storage model with self-similar input," Queueing Syst., vol. 16, pp. 387-396, 1994.
11. R. H. Reidi, M. S. Crouse, V. J. Ribeiro, and R. G. Baraniuk, "A multifractal wavelet model with application to network traffic," IEEE Trans. Inform. Theory, vol. 45, pp. 992-1018, Mar. 1999.
12. A. C. Gilbert, W. Willinger, and A. Feldmann, "Scaling analysis of conservative cascades with applications to network traffic," IEEE Trans. Inform. Theory, vol. 45, pp. 971-991, Mar. 1999.
13. M. Thottan and C. Ji, "Using network fault predictions to enable ip traffic management," J. Network Syst. Manage., 2000.
14. R. Maxion and F. E. Feather, "A case study of ethernet anomalies in a distributed computing environment," IEEE Trans. Reliability, vol. 39, pp. 433-443, Oct. 1990.
15. G. Vigna and R. A. Kemmerer, "Netstat: A network based intrusuion detection approach," in Proc. ACSAC, 1998.
16. J. Yang, P. Ning, X. S. Wang, and S. Jajodia, "Cards: A distributed system for detecting coordinated attacks," in Proc. SEC, 2000, pp. 171-180.
17. S. Savage, D. Wetherall, A. R. Karlin, and T. Anderson, "Practical network support for ip traceback," in Proc. ACM SIGCOMM, 2000, pp. 295-306.
18. CAIDA. Cooperative association for internet data analysis. [Online]. Available: http://www/caida.org/Tools.
19. W. S. Cleveland, D. Lin, and D. X. Sun, "Ip packet generation: Statistical models for tcp start times based on connection rate super position," in Proc. ACM SIGMETRICS, 2000, pp. 166-177.
20. R. Caceres, N. G. Duffield, A. Feldmann, J. Friedmann, A. Greenberg, R. Greer, T. Johnson, C. Kalmanek, B. Krishnamurthy, D. Lavelle, P. P. Mishra, K. K. Ramakrishnan, J. Rexford, F. True, and J. E. van der Merwe, "Measurement and analysis of ip network usage and behavior," IEEE Commun. Mag., pp. 144-151, May 2000.
21. P. Aukia, M. Kodialam, P. Koppol, T. Lakshman, H. Sarin, and B. Suter, "Rates: A server for mpls traffic engineering," IEEE Network Magazine, pp. 34-41, Mar./Apr. 2000.
22. W. Stallings, SNMP, SNMPv2, and CMIP The Practical Guide to Network Management Standards, 5th ed. Wellesley, MA: Addison-Wesley, 1994.
23. K. McCloghrie and M. Rose, "Management information base for network management of tcp/ip-based internets: Mib 2,", RFC1213, 1991.
24. M. Rose, The Simple Book: An Introduction to Internet Management, 2nd ed. Englewood Cliffs, NJ: Prentice-Hall, 1996.
25. T. D. Ndousse and T. Okuda, "Computational intelligence for distributed fault management in networks using fuzzy cognitive maps," in Proc. IEEE ICC, Dallas, TX, Jun. 1996, pp. 1558-1562.
26. L. Lewis, "A case based reasoning approach to the management of faults in communication networks," in Proc. IEEE INFOCOM, vol. 3, San Francisco, CA, Mar. 1993, pp. 1422-1429.
27. A. S. Franceschi, L. F. Kormann, and C. B. Westphall, "Performance evaluation for proactive network management," in Proc. IEEE ICC, Dallas, TX, June 1996, pp. 22-26.
28. L. Lewis and G. Dreo, "Extending trouble ticket systems to fault diagnosis," IEEE Network, vol. 7, pp. 44-51, Nov. 1993.
29. I. Katzela and M. Schwarz, "Schemes for fault identification in communication networks," IEEE/ACM Trans. Networking, vol. 3, pp. 753-764, Dec. 1995.
30. I. Rouvellou and G. Hart, "Automatic alarm correlation for fault identification," in Proc. IEEE INFOCOM, Boston, MA, Apr. 1995, pp. 553-561.
31. A. Bouloutas, G. Hart, and M. Schwartz, "On the design of observers for failure detection of discrete event systems," in Network Management and Control. New York: Plenum, 1990.
32. A. Lazar, W. Wang, and R. Deng, "Models and algorithms for network fault detection and identification: A review," in Proc. IEEE Int. Contr. Conf., 1992.
33. G. Jakobson and M. D. Weissman, "Alarm correlation," IEEE Network, vol. 7, pp. 52-59, Nov. 1993.
34. F. Feather and R. Maxion, "Fault detection in an ethernet network using anomaly signature matching," in Proc. ACM SIGCOMM, vol. 23, San Francisco, CA, Sept. 1993, pp. 279-288.
35. S. Papavassiliou, M. Pace, A. Zawadzki, and L. Ho, "Implementing enhanced network maintenance for transaction access services: Tools and applications," Proc. IEEE Int. Contr. Conf., vol. 1, pp. 211-215, 2000.
36. H. L. V. Trees, Detection, Estimation, and Modulation Theory. New York: Wiley, 1971, vol. 1.
37. C. Cohen-Tannoudji, B. Diu, and F. Laloe, Quantum Mechanics, 2nd ed. New York: Wiley, 1977, vol. 1.
38. M. Kirby and L. Sirovich, "Application of the Karhunen-Loeve procedure for the characterization of human faces," IEEE Trans. Pattern Anal. Machine Intell., vol. 12, pp. 103-108, Jan. 1990.
39. M. Thottan, "Network fault classification using abnormality vectors," in Proc. IFIP/IEEE Conf. Integrated Network Manage., Seattle, WA, 2001.
40. M. Thottan and C. Ji, "Proactive anomaly detection using distributed intelligent agents," IEEE Network, vol. 12, pp. 21-27, Sept./Oct. 1998.
41. C. Hood and C. Ji, "Proactive network fault detection," in Proc. IEEE INFOCOM, vol. 3, Kobe, Japan, Apr. 1997, pp. 1147-1155. [Online]. Available: http://neuron.ecse.rpi.edu/.
42. C. Hood, "Intelligent detection for fault management for communication networks," Ph.D. dissertation, Rensselaer Polytech. Inst., Troy, NY, 1996.
43. M. Mandjes, I. Saniee, S. Stolyar, and R. Schmidt, "Load characterization, overload prediction and load anomaly detection for voice over ip traffic," in Proc. 38th Annu. Allerton Conf. Commun., Contr. Comput., Nov. 2000.
44. L. Li, M. Thottan, B. Yao, and S. Paul, "Distributed network monitoring with bounded link utilizationin ip networks," in Proc. IEEE Infocom., 2003, to be published.
45. L. Zhang, Z. Liu, and C. Xia, "Clock synchronization algorithms for network measurements," in Proc. IEEE INFOCOM, 2002.
46. M. Wei, "Computer communication network traffic: Modeling, analysis and tests," M.S. Thesis, Rensselaer Polytechnic Inst., Troy, NY, 1996.