Combining visual and automated data mining for near-real-time anomaly detection and analysis in BGP

VizSEC/DMSEC '04: Proceedings of the 2004 ACM Workshop on Visualization and Data Mining for Computer Security

Volumn , Issue , 2004, Pages 35-44

  Teoh, Soon Tee ^a   Zhang, Ke ^a   Tseng, Shih Ming ^a   Ma, Kwan Liu ^a   Wu, S Felix ^a  

^a Davis   (United States)

Author keywords

Information visualization; Internet routing; Network visualization

Indexed keywords

INTERNET; NETWORK PROTOCOLS; OPTIMIZATION; PACKET NETWORKS; ROUTERS; SECURITY OF DATA; STATISTICAL METHODS; TOPOLOGY;

DATA PACKETS; INFORMATION VISUALIZATION; INTERNET ROUTING; NETWORK VISUALIZATION;

DATA MINING;

EID: 13944272563     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1029208.1029215     Document Type: Conference Paper

References (23)

1. C. Ahlberg and B. Shneiderman. Visual information seeking: Tight coupling of dynamic query filters with starfield displays. In Proceedings CHI'94: Human Factors in Computing Systems, pages 313-317, 1994.
2. The RIPE Routing Information Services. http://www.ris.ripe.net.
3. The Route Views Project. http://www.antc.uoregon.edu/route-views/.
4. Y. Rekhter and T. Li. A border gateway protocol 4 (BGP-4). Technical Report RFC 1771, The Internet Engineering Task Force, 1995.
5. C. Labovitz, G. Malan, and F. Jahanian. Internet Routing Instability. In Proceedings of ACM SIGCOMM, September 1997.
6. C. Labovitz, F. Jahanian, and G.R.Manlan. Origin of Internet Routing Stability. In Proceedings of the IEEE INFOCOM, June 1999.
7. C. Labovitz, A. Ahuja, A. Bose, and F. Jahanian. Delayed Internet Routing Convergence. In Proceedings of ACM SIGCOMM, August 2000.
8. A. Basu, C. Ong, A. Rasala, F. Shepherd, and G. Wilfong. Route Oscillations in I-BGP with Route Reflection. In Proceedings of ACM SIGCOMM, August 2002.
9. T. Griffin and G. Wilfong. Analysis of the MED Oscillation Problem in BGP. In Proceedings of ICNP, November 2002.
10. J. Rexford, J. Wang, Z. Xiao, and Y. Zhang. BGP Routing Stability of Popular Destinations. In Proceeds of Internet Measurement Workshop, November 2002.
11. O. Maennel and A. Feldmann. Realistic BGP Traffic for Test Labs. In Proceedings of the ACM SIGCOMM '02, August 2002.
12. R. F. Erbacher, K. L. Walker, and D. A. Fincke. Intrusion and misuse detection in large-scale systems. IEEE Computer Graphics and Applications, 22(1):38-48, January/February 2002.
13. W. Yurcik, K. Lakkaraju, J. Barlow, and J. Rosendale. A prototype tool for visual data mining of network traffic for intrusion detection. In Proceedings of the ICDM Workshop on Data Mining for Computer Security (DMSEC'03), 2003.
14. L. Girardin. An eye on network intruder-administrator shootouts. In Proceedings of the Workshop on Intrusion Detection and Network Monitoring (ID'99), Berkeley, CA, USA, 1999. USENIX Assoc.
15. K. Muniandy. Case study: Visualizing time related events for intrusion detection. In Proceedings of the IEEE Symposium on Information Visualization, 2000.
16. T. Takada and H. Koike. Tudumi: Information visualization system for monitoring and auditing computer logs. In Proceedings of the 6th International Conference on Information Visualization, 2002.
17. M. Ankerst, M. Ester, and H.-P. Kriegel. Towards an effective cooperation of the user and the computer for classification. In Proceedings of the 6th International Conference on Knowledge Discovery and Data Mining (KDD '00), 2000.
18. S. T. Teoh, K.-L. Ma, S. F. Wu, and X. Zhao. Case study: Interactive visualization for internet security. In Proceedings of the IEEE Visualization Conference 2002, pages 505-508, 2002.
19. S. T. Teoh, K.-L. Ma, and S. F. Wu. Visual exploration process for the analysis of internet routing data. In Proceedings of the IEEE Conference on Visualization 2003, pages 523-530, 2003.
20. C. Kruegel, D.Mutz, W. Robertson, and F. Valeur. Topology-based Detection of Anomalous BGP Messages. In RAID, 2003.
21. K. Zhang, A. Yen, X. Zhao, D. Massey, S.F. Wu, and L. Zhang. On Detection of Anomalous Routing Dynamics in BGP. In Proceedings of Networking, 2004.
22. Network Security Testbed based on Emulab. http://www.isi.deterlab.net.
23. H.S. Javitz and A. Valdes. The NIDES Statistical Components: Description and Justification. Technical report, SRI Network Information Center, March 1993.