Impact of packet sampling on anomaly detection metrics

Proceedings of the ACM SIGCOMM Internet Measurement Conference, IMC

Volumn , Issue , 2006, Pages 159-164

  Brauckhoff, Daniela ^a   Tellenbach, Bernhard ^a   Wagner, Arno ^a   May, Martin ^a   Lakhina, Anukool ^b  

^a ETH ZURICH   (Switzerland)

^b BOSTON UNIVERSITY   (United States)

Author keywords

Anomaly detection; Network traffic analysis; Sampling

Indexed keywords

ANOMALY DETECTION; NETWORK TRAFFIC ANALYSIS; PACKET SAMPLING; TRAFFIC DATA;

DATA REDUCTION; DATA STRUCTURES; PACKET NETWORKS; SAMPLING; TELECOMMUNICATION TRAFFIC;

NETWORK SECURITY;

EID: 34547464544     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1177080.1177101     Document Type: Conference Paper

References (21)

1. BARFORD, P., KLINE, J., PLONKA, D., AND RON, A. A signal analysis of network traffic anomalies. In Internet Measurement Workshop (Marseille, November 2002).
2. BRUTLAG, J. Aberrant behavior detection in timeseries for network monitoring. In USENIX LISA (New Orleans, December 2000).
3. CHOI, B.-Y., PARK, J., AND ZHANG, Z.-L. Adaptive random sampling for total load estimation. In IEEE International Conference on Communications (2003).
4. Cisco NetFlow. At www.cisco.com/warp/public/ 732/Tech/netflow/.
5. DUFFIELD, N., LUND, C., AND THORUP, M. Properties and prediction of flow statistics from sampled packet streams. In ACM SIGCOMM InternetMeasurment Workshop (2002).
6. DUFFIELD, N., LUND, C., AND THORUP, M. Estimating Flow Distributions from Sampled Flow Statistics. In ACM SIGCOMM (Karlsruhe, August 2003).
7. ESTAN, C., AND VARGHESE, G. New directions in traffic measurement and accounting. In Proceedings of the 2001 ACM SIGCOMM Internet Measurement Workshop (San Francisco, CA, 2001), pp. 75-80.
8. HOHN, N., AND VEITCH, D. Inverting Sampled Traffic. Internet Measurement Conference (Miami, October 2003).
9. JUNG, J., KRISHNAMURTHY, B., AND RABINOVICH, M. Flash crowds and denial of service attacks: Characterization and implications for cdns and web sites. In Proceedings of the International World Wide Web Conference (2002).
10. JUNG, J., PAXSON, V., BERGER, A., AND BALAKRISHNAN, H. Fast poitscan detection using sequential hypothesis testing. In Proceedings of the IEEE Symposium on Security and Privacy (2004).
11. KIM, M.-S., RANG, H.-J., HUNG, S.-C., CHUNG, S.-H., AND HONG, J. W. A Flow-based Method for Abnormal Network Traffic Detection. IEEE/IFIP Network Operations and Management Symposium (Seoul, 2004).
12. LAKHINA, A., CROVELLA, M., AND DIOT, C. Diagnosing Network-Wide Traffic Anomalies. ACM SIGCOMM (Portland, August 2004).
13. LAKHINA, A., CROVELLA, M., AND DIOT, C. Mining Anomalies Using Traffic Feature Distributions. ACM SIGCOMM (Philadelphia, August 2005).
14. MAI, J., CHUAH, C-N., SRIDHARAN, A., YE, T., AND ZANG, H. IS sampled data sufficient for anomaly detection? IMC 2006 (Rio de Janeiro, Brazil, October 2006).
15. MAI, J., SRIDHARAN, A., CHUAH, C-N., ZANG, H., AND YE, T. Impact of packet sampling on portscan detection. IEEE Journal on Selected Areas in Communication (2006).
16. MÜLLER, O., GRAF, D., OPPERMANN, A., AND WEIBEL, H. Swiss internet analysis, 2004. http://www.Swiss-internet-analysis.org/.
17. SRIDHARAN, A., YE, T., AND BHATTACHARRYA, S. Connectionless port scan detection on the backbone. Malware workshop, held in conjunction with IPCCC (Phoenix, AZ, April 2006).
18. SWITCH. Swiss academic and research network. http://www.switch.ch/, 2006.
19. WAGNER, A., AND PLATTNER, B. Entropy based worm and anomaly detection in fast ip networks. In Proceedings of the STCA security workshop/WETICE 2005 (2005).
20. WALLERICH, J., DREGER, H., FELDMANN, A., KRISHNAMURTHY, B., AND WILLINGER, W. A methodology for studying persistency aspects of internet flows. SIGCOMM Comput. Commun. Rev. 35, 2 (2005).
21. XU, K., ZHANG, Z.-L., AND B HATTACHARRYA, S. Profiling internet backbone traffic: Behavior models and applications. In ACM Sigcomm 2005 (Philadelphia, PA, August 2005).