Diagnosing network-wide traffic anomalies

Computer Communication Review

Volumn 34, Issue 4, 2004, Pages 219-230

  Lakhina, Anukool ^a   Crovella, Mark ^a   Diot, Christophe ^b  

^a BOSTON UNIVERSITY   (United States)

^b INTEL CORPORATION   (United States)

Author keywords

Anomaly Detection; Network Traffic Analysis

Indexed keywords

DETECTION; NETWORK TRAFFIC ANALYSIS; NOISY DATA; TRAFFIC ANOMALIES;

CONGESTION CONTROL (COMMUNICATION); DATA REDUCTION; MEASUREMENT THEORY; PRINCIPAL COMPONENT ANALYSIS; SPURIOUS SIGNAL NOISE; TELECOMMUNICATION LINKS; WIRELESS TELECOMMUNICATION SYSTEMS;

TELECOMMUNICATION TRAFFIC;

EID: 21844451952     PISSN: 01464833     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1030194.1015492     Document Type: Conference Paper

References (25)

1. P. Barford, J. Kline, D. Plonka, and A. Ron. A Signal Analysis of Network Traffic Anomalies. In Internet Measurement Workshop, 2002.
2. J. Brutlag. Aberrant Behavior Detection in Timeseries for Network Monitoring. In USENIX Fourteenth Systems Administration Conference (LISA), 2000.
3. NetFlow. At www.cisco.com/warp/public/732/Tech/netflow/.
4. D. Donoho and G. Flesia and N. El-Karoui and M. Elad. Inferring Sparse Causes for Extreme Network Events. In Network Modeling and Simulation Workshop at Dartmouth College, 2002.
5. R. Dunia and S. J. Qin. Multi-dimensional Fault Diagnosis Using a Subspace Approach. In American Control Conference, 1997.
6. R. Dunia and S. J. Qin. A Subspace Approach to Multidimensional Fault Identification and Reconstruction. American Institute of Chemical Engineers (AIChE) Journal, pages 1813-1831, 1998.
7. F. Feather, D. Siewiorek, and R. Maxion. Fault Detection in an Ethernet Network Using Anomaly Signature Matching. In ACM SIGCOMM, 1993.
8. A. Feldmann, A. Greenberg, C. Lund, N. Reingold, J. Rexford, and F. True. Deriving Traffic Demands for Operational IP networks: Methodology and Experience. In IEEE/ACM Transactions on Neworking, 2001.
9. G. Golub and C. F. V. Loan. Matrix Computations. The Johns Hopkins University Press.
10. C. Hood and C. Ji. Proactive Network Fault Detection. In IEEE INFOCOM, 1997.
11. J. E. Jackson and G. S. Mudholkar. Control Procedures for Residuals Associated with Principal Component Analysis. Technometrics, pages 341-349, 1979.
12. D. R. Jensen and H. Solomon. A Gaussian Approximation to the Distribution of a Definite Quadratic Form. J. of the American Statistical Association, pages 898-902, 1972.
13. I. Katzela and M. Schwanz. Fault Identification Schemes in Communication Networks. In IEEE/ACM Transactions on Neworking, December 1995.
14. B. Krishnamurthy, S. Sen, Y. Zhang, and Y. Chen. Sketch-based Change Detection: Methods, Evaluation, and Applications. In Internet Measurement Conference, 2003.
15. A. Lakhina, M. Crovella, and C. Diot. Characterization of Network-Wide Anomalies in Traffic Flows. Technical Report BUCS-2004-020, Boston University, 2004.
16. A. Lakhina, K. Papagiannaki, M. Crovella, C. Diot, E. D. Kolaczyk, and N. Taft. Structural Analysis of Network Traffic Flows. In ACM SIGMETRICS, 2004.
17. A. A. Lazar, W. Wang, and R. Deng. Models and Algorithms for Network Fault Detection and Identification: A Review. In ICC, 1992.
18. A. Medina, N. Taft, K. Salamatian, S. Bhattacharyya, and C. Diot. Traffic Matrix Estimation: Existing Techniques and New Directions. In ACM SIGCOMM, 2002.
19. M. Misra, H. H. Yue, S. J. Qin, and C. Ling. Multivariate Process Monitoring and Fault Diagnosis by Multi-scale PCA. Computers and Chemical Engineering, pages 1281-1293, 2002.
20. M. Moonen, P. Dooren, and J. Vandewalle. A Singular Value Decomposition Updating Algorithm for Subspace Tracking. SIAM J. Matrix Anal. Appl., pages 1015-1038, 1992.
21. M. Roughan, T. Griffin, M. Mao, A. Greenberg, and B. Freeman. Combining Routing and Traffic Data for Detection of IP Forwarding Anomalies (Poster). In ACM SIGMETRICS, 2004.
22. Juniper Traffic Sampling. At www.juniper.net/techpubs/software/junos/ junos60/swconfig60-policy/html/sampling-overview.html.
23. Y. Vardi. Network Tomography: Estimating Source-Destination Traffic Intensities from Link Data. J. of the American Statistical Association, pages 365-377, 1996.
24. N. Ye. A Markov Chain Model of Temporal Behavior for Anomaly Detection. In Workshop on Information Assurance and Security, 2000.
25. Y. Zhang, M. Roughan, C. Lund, and D. Donoho. An Information-Theoretic Approach to Traffic Matrix Estimation. In ACM SIGCOMM, 2003.