Profiling internet backbone traffic: Behavior models and applications

Computer Communication Review

Volumn 35, Issue 4, 2005, Pages 169-180

  Xu, Kuai ^a   Zhang, Zhi Li ^a   Bhattacharyya, Supratik ^b  

^a University of Minnesota   (United States)

^b Sprint Applied Research & Advanced Technology Labs California   (United States)

Author keywords

Behavior profiles; Network monitoring; Traffic measurement

Indexed keywords

COMPUTER CRIME; DATA MINING; INTERNET; MATHEMATICAL MODELS; PATTERN RECOGNITION; SECURITY OF DATA; CLASSIFICATION (OF INFORMATION); COMPUTER ARCHITECTURE; INFORMATION MANAGEMENT; INFORMATION THEORY; NETWORK ARCHITECTURE; NETWORK SECURITY;

BEHAVIOR PROFILES; CLUSTER EXTRACTION; NETWORK MONITORING; TRAFFIC MEASUREMENT;

TELECOMMUNICATION TRAFFIC; INTERNET PROTOCOLS;

BEHAVIOR CLASSIFICATION; BEHAVIOR PROFILES; COMMUNICATION PATTERN; GENERAL METHODOLOGIES; INFORMATION THEORETIC TECHNIQUES; NETWORK MONITORING; STRUCTURAL MODELING; TRAFFIC MEASUREMENTS;

EID: 33750711125     PISSN: 01464833     EISSN: 01464833     Source Type: Conference Proceeding    
DOI: 10.1145/1090191.1080112     Document Type: Conference Paper

References (30)

1. B. Krishnamurthy, S. Sen, Y. Zhang, and Y. Chen, "Sketch-based Change Detection: Methods, Evaluation, and Applications," in Proc. of ACM/USENIX IMC, 2003.
2. G. Cormode, F. Korn, S. Muthukrishnan and D. Srivastava, "Finding hierarchical heavy hitters in data streams," in Proc. of VLDB, 2003.
3. S. Staniford, J. Hoagland, and J. McAlerney, "Practical automated detection of stealthy portscans," Journal of Computer Security, vol. 10, pp. 105-136, 2002.
4. J. Jung and V. Paxson and A. Berger and H. Balakrishna, "Fast portscan detection using sequential hypothesis testing," in Proc. of IEEE Symposium on Security and Privacy, 2004.
5. J. Jung, B. Krishnamurthy, and M. Rabinovich, "Flash Crowds and Denial of Service Attacks: Characterization and Implications for CDNs and Web Sites," in Prvc. of International World Wide Web Conference, 2002.
6. N. Weaver, V. Paxon, S. Staniford and R. Cunningham, "A taxonomy of computer worms," in Proc. of CCS Workshop on Rapid Malcode(WORM), 2003.
7. V. Yegneswaran, P. Barford and J. Ullrich, "Internet intrusions: global characteristics and prevalence," in Proc. of ACM BIOMETRICS, 2003.
8. R. Pang, V. Yegneswaran, P. Barford, V. Paxson and L. Peterson, "Characteristics of Internet Background Radiation," in Proc. of ACM SIGCOMM IMC, 2004.
9. A. Lakhina, M. Crovella, and C. Diot, "Diagnosing Network-Wide Traffic Anomalies," in Proc. of ACM SIGCOMM, 2004.
10. A. Lakhina, M. Crovella and C. Diot, "Characterization of Network-Wide Anomalies in Traffic Flows," in Proc. of ACM SIGCOMM IMC, 2004.
11. P. Barford, J. Kline, D. Plonka, and A. Ron, "A signal analysis of network traffic anomalies," in Proc. of ACM SIGCOMM IMW, 2002.
12. "SNORT," http://www.snort.org/.
13. V. Paxson, "Bro: A System for Detecting Network Intruders in Real-Time," Computer Networks, vol. 31, pp. 2435-2463, Dec 1999.
14. MINDS, "Minnesota Intrusion Detection System," http://www.cs.umn.edu/research/minds/.
15. A. Lazarevic, L. Ertoz, A. Ozgur, J. Srivastava and V. Kumar, "A comparative study of anomaly detection schemes in network intrusion detection," in Proc. of SIAM Conf. Data Mining, 2003.
16. W. Lee and D. Xiang, "Information-Theoretic Measures for Anomaly Detection," in Proc. of IEEE Symposium on Security and Privacy, 2001.
17. C. Estan, S. Savage, and G. Varghese, "Automatically Inferring Patterns of Resource Consumption in Network Traffic," in Proc. of ACM SIGCOMM, September 2003.
18. F. Hernandez-Campos, A. B. Nobel, F. D. Smith, and K. Jeffay, "Statistical Clustering of Internet Communication Patterns," in Proc. of Symposium on the Interface of Computing Science and Statistics, 2003.
19. S. J. Stolfo, S. Hershkop, K. Wang, O. Nimeskern, and C. Hu, "Behavior Profiling of Email," in Proc. of NSF/NIJ Symposium on Intelligence & Security Informatics, 2003.
20. T. Karagiannis, K. Papagiannaki and M. Faloutsos, "BLINC: Multilevel Traffic Classification in the Dark," in Proc. of ACM SIGCOMM, August 2005.
21. A. Lakhina, M. Crovella and C. Diot, "Mining Anomalies Using Traffic Feature Distributions," in Proc. of ACM SIGCOMM, August 2005.
22. C. E. Shannon and W. Weaver, The Mathematical Theory of Communication. University of Illinois Press, 1949.
23. T. Cover and J. Thomas, Elements of Information Theory. Wiley Series in Telecommunications, 1991.
24. k. claffy, H.-W. Braun, and G. Polyzos, "A parameterizable methodology for Internet traffic flow profiling," IEEE Journal of Selected Areas in Communications, 1995.
25. K. Xu, Z.-L. Zhang and S. Bhattacharyya, "Profiling Internet Backbone Traffic: Behavior Models and Applications," Sprint ATL Research Report RR05-ATL-020777, Tech. Rep., February 2005.
26. K. Krippendorff, Information theory: structural models for qualitative data. Sage Publications, 1986.
27. R. Cavallo and G. Klir, "Reconstructability analysis of multi-dimensional relations: A theoretical basis for computer-aided determination of acceptable systems models," International Journal of General Systems, vol. 5, pp. 143-171, 1979.
28. M. Zwick, "An overview of reconstructability analysis," International Journal of Systems & Cybernetics, 2004.
29. M. Jordan, "Graphical models," Statistical Science, Special Issue on Bayesian Statistics, vol. 19, pp. 140-155, 2004.
30. K. Xu, Z.-L. Zhang and S. Bhattacharyya, "Reducing Unwanted Traffic in a Backbone Network," in Proc. of Steps to Reducing Unwanted Traffic on the Internet Workshop (SRUTI), July 2005.