Sketch-based change detection: Methods, evaluation, and applications

Proceedings of the ACM SIGCOMM Internet Measurement Conference, IMC

Volumn , Issue , 2003, Pages 234-247

  Krishnamurthy, Balachander ^a   Sen, Subhabrata ^a   Zhang, Yin ^a   Chen, Yan ^b  

^a AT AND T LABS RESEARCH   (United States)

^b UNIVERSITY OF CALIFORNIA   (United States)

Author keywords

Change Detection; Data Stream Computation; Forecasting; Network Anomaly Detection; Sketch; Time Series Analysis

Indexed keywords

AUTOMATION; COMPUTER NETWORKS; COMPUTER SCIENCE; COST EFFECTIVENESS; DATA FLOW ANALYSIS; FORECASTING; SIGNAL DETECTION; SOFTWARE ENGINEERING; TELECOMMUNICATION TRAFFIC; TIME SERIES ANALYSIS;

CHANGE DETECTION; DATA STREAM COMPUTATION; NETWORK ANOMALY DETECTION; SKETCH;

TELECOMMUNICATION NETWORKS;

EID: 14944367082     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (40)

1. N. Alon, Y. Matias, and M. Szegedy. The space complexity of approximating the frequency moments. Journal of Computer and System Sciences, 58(1):137-147, 1999.
2. H. Arsham. Time series analysis and forecasting techniques. http://obelia.jde.aca.mmu.ac.uk/resdesgn/arsham/opre330Forecast.htm.
3. P. Barford, J. Kline, D. Plonka, and A. Ron. A signal analysis of network traffic anomalies. In Proceedings of the ACM SIGCOMM Internet Measurement Workshop, Marseille, France, November 2002.
4. P. Barford and D. Plonka. Characteristics of network traffic flow anomalies. In Proceedings of the ACM SIGCOMM Internet Measurement Workshop, San Francisco, CA, November 2001.
5. G. E. P. Box, W. G. Hunter, and J. S. Hunter. Statistics for Experimenters. John Wiley, 1978.
6. G. E. P. Box and G. M. Jenkins. Time Series Analysis, Forecasting and Control. Holden-Day, 1976.
7. G. E. P. Box, G. M. Jenkins, and G. C. Reinsel. Time Series Analysis, Forecasting and Control, Prentice-Hall, Englewood Cliffs, 1994.
8. P. Brockwell and R. Davis. Introduction to Time Series and Forecasting. Springer, 1996.
9. J. Brutlag. Aberrant behavior detection in time series for network monitoring. In Proc. USENIX LISA XIV, New Orleans, LA, December 2000. http://www.usenix.org/events/lisa2000/full_papers/brutlag/brutlag_html/index. html.
10. J. Carter and M. Wegman. Universal classes of hash functions. Journal of Computer and System Sciences, 18:143-154, 1979.
11. M. Charikar, K. Chen, and M. Farach-Colton. Finding frequent items in data streams. In Proc. of ICALP 2002, pages 693-703, 2002. http://www.cs.princeton.edu/~moses/papers/frequent.ps.
12. C. Chen and L.-M. Liu. Forecasting time series with outliers. Journal of Forecasting, 12:13-35, 1993.
13. C. Chen and L.-M. Liu. Joint estimation of model parameters and outlier effects in time series. Journal of the American Statistical Association, 88:284-297, 1993.
14. G. Cormode and S. Muthukrishnan. What's hot and what's not: Tracking most frequent items dynamically. In Proc. ACM PODC '2003, July 2003.
15. M. Datar and S. Muthukrishnan. Estimating rarity and similarity over data stream windows. Technical Report 2001-21, DIMACS Technical Report, November 2001.
16. N. Devillard. Fast median search: an ansi c implementation, July 1998. http://ndevilla.free.fr/median/median.pdf.
17. C. Estan and G. Varghese. New directions in traffic measurement and accounting. In Proc. ACM SIGCOMM '2002, Pittsburgh, PA, August 2002.
18. F. Feather, D. Siewiorek, and R. Maxion. Fault detection in an ethernet network using anomaly signature matching. In Proc. ACM SIGCOMM '93, 1993.
19. S. Floyd, M. Handley, J. Padhye, and J. Widmer. Equation-based congestion control for unicast applications. In Proc. ACM SIGCOMM '00, August 2000.
20. K. Fox, R. Henning, J. Reed, and R. Simonian. A neural network approach towards intrusion detection. Technical report, Technical Report, Harris Corporation, July 1990.
21. A. C. Gilbert, S. Guha, P. Indyk, S. Muthukrishnan, and M. J. Strauss. Quicksand: Quick summary and analysis of network data. Technical Report 2001-43, DIMACS Technical Report, November 2001.
22. C. Hood and C. Ji. Proactive network fault detection. In Proc. IEEE INFOCOM '97, Kobe, Japan, April 1997.
23. K. J. Houle, G. M. Weaver, N. Long, and R. Thomas. Trends in Denial of Service Attack Technology. http://www.cert.org/archive/pdf/DoS_trends.pdf.
24. P. Indyk. Stable distributions, pseudorandom generators, embeddings and data stream computation. In Proc. of the 41st Symposium on Foundations of Computer Science, 2000.
25. J. Jung, B. Krishnamurthy, and M. Rabinovich. Flash Crowds and Denial of Service Attacks: Characterization and Implications for CDNs and Web Sites. In Proceedings of the World Wide Web Conference, Honolulu, Hawaii, May 2002. http://www.research.att.com/~bala/papers/www02-fc.html.
26. I. Katzela and M. Schwartz. Schemes for fault identification in communication networks. IEEE/ACM Transactions on Networking, 3(6):753-764, December 1995.
27. M. J. Lebo and W. H. Moore. Foreign policy behavior and fractional integration. Journal of Conflict Resolution, 1(47):13-32, February 2003. http://garnet.acns.fsu.edu/~whmoore/research/Lebo&Moore2003.pdf.
28. D. Moore, V. Paxson, S. Savage, C. Shannon, S. Staniford, and N. Weaver. The Spread of the Sapphire/Slammer Worm. Technical report, Technical Report, February 2003. http://www.cs.berkeley.edu/~nweaver/sapphire/.
29. D. Moore, G. Voelker, and S. Savage. Inferring Internet Denial of Service Activity. In Proc. of the USENIX Security Symposium, Washington D.C., August 2001. http://www.cs.ucsd.edu/~savage/papers/UsenixSec01.pdf.
30. S. Muthukrishnan. Data streams: Algorithms and applications, 2003. Manuscript based on invited talk from 14th SODA. Available from http://www.cs.rutgers.edu/~muthu/stream-l-l.ps.
31. V. Paxson. Bro: A System for Detecting Network Intruders in Real-Time. Computer Networks, 31(23-24):2435-2463, December 1999. ftp://ftp.ee.lbl.gov/papers/bro-CN99.ps.gz.
32. M. Roesch. Snort - Lightweight Intrusion Detection for Networks. In Proc. USENIX Lisa '99, Seattle, WA, November 1999.
33. M. Thorup and Y. Zhang. Tabulation based 4-universal hashing with applications to second moment estimation, 2003. Under submission. Available from http://www.research.att.com/~yzhang/papers/hash-tm03.ps.
34. J. Toelle and O. Niggemann. Supporting intrusion detection by graph clustering and graph drawing. In Proc. RAID '2000, Toulouse, France, October 2000.
35. R. S. Tsay. Time series model specification in the presence of outliers. Journal of the American Statistical Association, 81:132-141, 1986.
36. R. S. Tsay. Outliers, level shifts, and variance changes in time series. Journal of Forecasting, 7:1-20, 1988.
37. T.S.Huang, G. J. Yang, and G. Y. Tang. A fast two-dimensional median filtering algorithm. IEEE transactions on acoustics, speech and signal processing, 27(1), February 1979.
38. A. Ward, P. Glynn, and K. Richardson. Internet service performance failure detection. Performance Evaluation Review, August 1998.
39. M. Wegman and J. Carter. New hash functions and their use in authentication and set equality. Journal of Computer and System Sciences, 22:265-279, 1981.
40. N. Ye. A markov chain model of temporal behavior for anomaly detection. In Workshop on Information Assurance and Security, West Point, NY, June 2000.