Dynamic modeling of internet traffic for intrusion detection

Eurasip Journal on Advances in Signal Processing

Volumn 2007, Issue , 2007, Pages

  Shah, Khushboo ^a   Jonckheere, Edmond ^b   Bohacek, Stephan ^c  

^a Nevis Networks Inc   (United States)

^b University of Southern California ^*  (United States)

^c UNIVERSITY OF DELAWARE   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

COMPUTER CRIME; COMPUTER NETWORKS; COMPUTER SIMULATION; CORRELATION METHODS; ELECTRONIC DOCUMENT IDENTIFICATION SYSTEMS; INTERNET; SECURITY OF DATA;

CANONICAL CORRELATION ANALYSIS; DYNAMIC MODELING; INTERNET TRAFFIC;

TELECOMMUNICATION TRAFFIC;

EID: 33846255909     PISSN: 11108657     EISSN: 16870433     Source Type: Journal    
DOI: 10.1155/2007/90312     Document Type: Article

References (58)

1. S. Kent On the trail of intrusions into information systems. IEEE Spectrum 37 12 2000 52 56
2. D. Moore G. Voelker S. Savage Inferring internet denial of service activity. Proceedings of the 10th USENIX Security Symposium Washington, DC, USA 2001
3. V. Paxson vern@aciri.org Bro: a system for detecting network intruders in real-time. IEEE Computer Networks 31 23-24 1999 2435 2463
4. M. Roesch Snort-lightweight intrusion detection for networks. Proceedings of the USENIX LISA Conference on System Administration Seattle, Wash, USA 1999 229 238
5. S. Staniford J. A. Hoagland J. M. McAlerney Practical automated detection of stealthy portscans. Journal of Computer Security 10 1-2 2002 105 136
6. M. Basseville I. Nikiforov Detection of Abrupt Changes: Theory and Application. Prentice Hall Englewood Cliffs, NJ, USA 1993
7. H. Wang hnw@cs.wm.edu D. Zhang dzhang@qualcomm.com K. G. Shin kgshin@eecs.umich.edu Change-point monitoring for the detection of DoS attacks. IEEE Transactions on Dependable and Secure Computing 1 4 2004 193 208
8. V. A. Siris vsiris@ics.forth.gr F. Papagalou Application of anomaly detection algorithms for detecting SYN flooding attacks. Proceedings of the IEEE Global Telecommunications Conference (GLOBECOM '04) 4 Dallas, Tex, USA 2004 2050 2054
9. C. Wong S. Bielski J. M. McCune C. Wang A study of mass-mailing worms. Proceedings of the ACM CCS Workshop on Rapid Malcode (WORM '04) Washington, DC, USA 2004
10. D. Whyte E. Kranakis P. C. van Oorschot DNS-based detection of scanning worms in an enterprise network. Proceedings of the 12th Annual Network and Distributed System Security Symposium (NDSS '05) San Diego, Calif, USA 2005
11. D. Whyte E. Kranakis P. C. van Oorschot ARP-based detection of scanning worms within an enterprise network. Proceedings of the 21st Annual Computer Security Applications Conference (ACSAC '05) Tucson, Ariz, USA 2005
12. J. Mirkovic G. Prier P. L. Reiher Attacking DDoS at the source. Proceedings of the IEEE International Conference on Network Protocols (ICNP '02) Paris, France 2002 312 321
13. K. Shah khushboo@usc.edu S. Bohacek bohacek@eecis.udel.edu E. Jonckheere jonckhee@usc.edu On the predictability of data network traffic. Proceedings of the American Control Conference (ACC '03) 2 Denver, Colo, USA 2003 1619 1624
14. C. S. Wallace csw@cs.monash.edu.au D. L. Dowe Minimum message length and Kolmogorov complexity. The Computer Journal 42 4 1999 270 283
15. E. Jonckheere J. Helton Power spectrum reduction by optimal hankel norm approximation of the phase of the outer spectral factor. IEEE Transactions on Automatic Control 30 12 1985 1192 1201
16. A. Zvonkin L. Levin The complexity of finite objects and the development of the concepts of information and randomness by means of the theory of algorithms. Russian Mathematical Surveys 25 1970 6 83 124
17. D. M. Sow A. Eleftheriadis Complexity distortion theory. IEEE Transactions on Information Theory 49 2003 3 604 608
18. Y. I. Manin A Course in Mathematical Logic. Springer New York, NY, USA 1977
19. H. Akaike Markovian representation of stochastic processes by canonical variables. SIAM Journal on Control 13 1 1975 162 173
20. L. Breiman J. H. Friedman Estimating optimal transformations for multiple regression and correlation. Journal of the American Statistical Association 80 1985 580 619
21. M. Sipser Introduction to the Theory of Computation. PWS Boston, Mass, USA 1997
22. V. V. Nemytskii V. V. Stepanov Qualitative Theory of Differential Equations. Dover New York, NY, USA 1989
23. F. Brini S. Siboni G. Turchetti S. Vaienti Decay of correlations for the automorphism of the torus T2. Nonlinearity 10 5 1997 1257 1268
24. N. Haydn E. A. Jonckheere On mutual information. http://eudoxus.usc.edu/ CHAOS/traffic.html
25. W. Stallings High-Speed Networks TCP/IP and ATM Design Principles. Prentice Hall Englewood Cliffs, NJ, USA 1st 1998
26. M. E. Crovella A. Bestavros Self-similarity in world wide web traffic: evidence and possible causes. IEEE/ACM Transactions on Networking 5 6 1997 835 846
27. A. Feldmann A. C. Gilbert W. Willinger Data networks as cascades: investigating the multifractal nature of Internet WAN traffic. Proceedings of the ACM Conference on Applications, Technologies, Architectures, and Protocols for Computer Communication (SIGCOMM '98) Vancouver, BC, Canada 1998 42 55
28. N. X. Liu J. S. Baras On scaling property of network traffic in small scales. submitted to Computer Networks
29. http://www.isi.edu/nsnam
30. D. E. Denning An intrusion detection model. IEEE Transactions on Software Engineering 13 1987 2 222 232
31. A. Ghosh J. Wanken F. Charron Detection anomalous and unknown intrusions agains programs. Proceedings of the 14th Annual Computer Security Applications Conference (ACSAC '98) Scottsdale, Ariz, USA 1998 259 267
32. H. S. Javitz A. Valdes The SRI IDES statistical anomaly detector. Proceedings of the IEEE Computer Society Symposium on Research in Security and Privacy Oakland, Calif, USA 1991 316 326
33. C. Ko M. Ruschitzka K. Levitt Execution monitoring of security-critical programs in distributed systems: a specification-based approach. Proceedings of the IEEE Computer Society Symposium on Research in Security and Privacy Oakland, Calif, USA 1997 175 187
34. T. Lane C. E. Brodley Temporal sequence learning and data reduction for anomaly detection. Proceedings of the 5th ACM Conference on Computer and Communications Security (CCS '98) San Francisco, Calif, USA 1998 150 158
35. W. Lee S. Stolfo A framework for constructing features and models for intrusion detection systems. Proceedings of the 5th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining San Diego, Calif, USA 1999
36. S. Forrest S. A. Hofmeyr A. Somayaji T. A. Longstaff A sense of self for unix processes. Proceedings of the IEEE Symposium on Security and Privacy Oakland, Calif, USA 1996 120 128
37. R. Anderson A. Khattak The use of information retrieval techniques for intrusion detection. Proceedings of the 1st International Workshop on the Recent Advances in Intrusion Detection (RAID '98) Louvain-la-Neuve, Belgium 1998
38. H. S. Teng K. Chen S. C.-Y. Lu Adaptive real-time anomaly detection using inductively generated sequential patterns. Proceedings of the IEEE Computer Society Symposium on Research in Security and Privacy Oakland, Calif, USA 1990 278 284
39. T. Lunt A. Tamaru F. Gilham A real-time intrusion detection expert system (IDES). Computer Science Laboratory, SRI International Menlo Park, Calif, USA 1992
40. R. B. Blazek H. Kim B. Rozovskii A. Tartakovsky A novel approach to detection of denial-of service attacks via adaptive sequential and batch sequential change-point detection methods. Proceedings of the 2nd Annual IEEE Systems, Man, and Cybernetics Information Assurance Workshop New York, NY, USA 2001
41. H. Wang D. Zhang K. Shin Detecting SYN flooding attacks. Proceedings of the 21st Annual Joint Conference of the IEEE Computer and Communications Societies (INFOCOM '02) 3 New York, NY, USA 2002 1530 1539
42. V. Alarcon-Aquino J. A. Barria Anomaly detection in communication networks using wavelets. IEE Proceedings: Communications 148 6 2001 355 362
43. M. Thottan C. Ji Anomaly detection in IP networks. IEEE Transactions on Signal Processing 51 2003 8 2191 2204
44. P. Barford pb@cs.wisc.edu J. Kline kline@math.wisc.edu D. Plonka plonka@doit.wisc.edu A. Ron amos@cs.wisc.edu A signal analysis of network traffic anomalies. Proceedings of the 2nd ACM SIGCOMM Internet Measurement Workshop (IMW '02) Marseille, France 2002 71 82
45. C.-M. Cheng H. T. Kung K.-S. Tan Use of spectral analysis in defense against DoS attacks. Proceedings of the IEEE Global Telecommunications Conference (GLOBECOM '02) Taipei, Taiwan 3 2002 2143 2148
46. A. Hussain J. Heidemann C. Papadopoulos A framework for classifying denial of service attacks. Proceedings of the ACM Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications (SIGCOMM '03) Karlsruhe, Germany 2003 99 110
47. C. Partridge D. Cousins A. Jackson R. Krishnan T. Saxena W. T. Strayer Using signal processing to analyze wireless data traffic. Proceedings of the ACM Workshop on Wireless Security Atlanta, Ga, USA 2002
48. Z.-L. Zhang V. Ribeiro S. Moon C. Diot Small-time scaling behaviors of Internet backbone traffic: an empirical study. Proceedings of the 22nd Annual Joint Conference of the IEEE Computer and Communications Societies (INFOCOM '03) 3 San Francisco, Calif, USA 2003 1826 1836
49. S. Evans S. F. Bush J. Hershey Information assurance through Kolmogorov complexity. Proceedings of the 2nd DARPA Information Survivability Conference and Exposition II (DISCEX-II '01) Anaheim, Calif, USA 2001
50. G. Samoradnitsky M. S. Taqqu Stable Non-Gaussian Random Processes, Stochastic Models with Infinite Variance. Chapman & Hall New York, NY, USA 1994
51. E. Jonckheere B.-F. Wu Mutual Kolmogorov-Sinai entropy approach to nonlinear estimation. Proceedings of the IEEE Conference on Decision and Control Tucson, Ariz, USA 1992 2226 2232
52. S. Kullback Information Theory and Statistics. Dover New York, NY, USA 1968
53. B. F. Wu Identification and control of chaotic processes - the Kolmogorov-Sinai entropy approach. Department of Electrical Engineering, University of Southern California Los Angeles, Calif, USA 1992 Ph.D. dissertation
54. W. E. Larimore Identification and filtering of nonlinear systems using canonical variate analysis. Nonlinear Modeling and Forecasting SFI Studies in the Sciences of Complexity 12 Addison-Wesley Reading, Mass, USA 1991 283 303
55. W. Leland M. Taqqu W. Willinger D. Wilson On the self-similar nature of Ethernet traffic (extended version). IEEE/ACM Transactions on Networking 2 1 1994 1 15
56. P. Pruthi A. Erramilli Heavy-tailed ON/OFF source behavior and self-similar traffic. IEEE International Conference on Communications 1 Seattle, Wash, USA 1995 445 450
57. CERT CERT advisory CA-96.01: UDP port denial-of-service attack. ftp://info.cert.org/pub/cert_advisories/ca-96.01.udp_service_denial
58. ERT Coordination Center Overview of attack trends. http://www.cert.org/ archive/pdf/attacktrends.pdf