Intelligent flow-based sampling for effective network anomaly detection

GLOBECOM - IEEE Global Telecommunications Conference

Volumn , Issue , 2007, Pages 1948-1953

  Androulidakis, G ^a   Papavassiliou, S ^a  

^a NATIONAL TECHNICAL UNIVERSITY OF ATHENS NTUA   (Greece)

Author keywords

Anomaly detection; Sampling; Traffic measurements

Indexed keywords

ANOMALY DETECTION; FLOW SAMPLING; NETWORK ATTACKS; TRAFFIC MEASUREMENTS;

COMPUTER WORMS; INTELLIGENT AGENTS; SCALABILITY; TELECOMMUNICATION TRAFFIC;

INTRUSION DETECTION;

EID: 39349111817     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/GLOCOM.2007.374     Document Type: Conference Paper

References (18)

1. L. Deri and S. Suin, "Effective Traffic Measurement Using ntop", IEEE Com. Mag., vol.38, no.5, pp. 138-143, May 2000.
2. P. Barford, J. Kline, D. Plonka, and A. Ron, "A Signal Analysis of Network Traffic Anomalies", in Proc. of the 2nd ACM SIGCOMM Workshop on Internet measurement, pp. 71-82, 2002.
3. N. Ye, S. Emran, Q. Chen, S. Vilbert, "Multivariate Statistical Analysis of Audit Trails for Host-Based Intrusion Detection", IEEE Transactions on Computers, Vol. 51, No. 7, July 2002.
4. W. Lee and D. Xiang, "Information-Theoretic Measures for Anomaly Detection", In Proc. of the IEEE Symposium on Security and Privacy (S&P 2001), pp. 130 -143, 2001.
5. P. Barford and D. Plonka, "Characteristics of network traffic flow anomalies", In Proc. of the First ACM SIGCOMM Internet Measurement Workshop, pp. 69-74, 2001.
6. A. Sridharan, T. Ye, and S. Bhattacharyya, "Connectionless Port Scan Detection on the Backbone," in Malware Workshop (in conjunction with IEEE IPCCC 2006), Phoenix, Arizona, USA, April 2006.
7. J. Mai, A. Sridharan, C.N. Chuah, H. Zang and T. Ye, "Is sampled data sufficient for anomaly detection?", Internet Measurement Conference 2006, Rio de Janeiro, Brazil, October 2006.
8. N.G. Duffield and C. Lund, "Predicting Resource Usage and Estimation Accuracy in an IP Flow Measurement Collection Infrastructure", ACM SIGCOMM Internet Measurement Conference 2003, Miami Beach, Fl, October 27-29, 2003.
9. T. Peng, C. Leckie, K. Ramamohanarao, "Proactively Detecting Distributed Denial of Service Attacks Using Source IP Address Monitoring", In Proc. of the Third International IFIP-TC6 Net-working Conference, Athens, Greece, May 2004.
10. N. Duffield, C. Lund, and M. Thorup, "Estimating Flow Distributions From Sampled Flow Statistics", IEEE/ACM Transactions on Networking, Vol. 13, No. 5, pp. 933-946, October 2005.
11. C. Estan, K. Keys, D. Moore, G. Varghese, "Building a Better Netflow", Proceedings of the ACM SIGCOMM'04, Portland, Ore-gon, USA, August 2004.
12. B.Y. Choi, J. Park, Z.L. Zhang, "Adaptive Packet Sampling for Accurate and Scalable Flow Measurement", Global Telecommunications Conference (GLOBECOM'04), 2004.
13. Li-Bo Xu, Guo-Xin Wu, Jian-Fei Li, "Packet-Level Adaptive Sampling on Multi-Fluctuation Scale Traffic", Proceedings of International Conference on Communications, Circuits and Systems, pp. 604-608 Vol. 1, May 2005.
14. Nicolas Hohn, Darryl Veitch, "Inverting sampled traffic", In Proceedings of the 3rd ACM SIGCOMM conference on Internet measurement, pp. 222-233, Miami, FL, USA, 2003.
15. J. Mai, A. Sridharan, C.N. Chuah, H. Zang and T. Ye, "Impact of Packet Sampling on Portscan Detection", IEEE Journal on Selected Areas in Communication, vol.24, no 12, pp. 2285-2298, 2006.
16. C Estan and G. Varghese, "New Directions in Traffic Measurement and Accounting", In Proc. of SIGCOMM'02, Pittsburgh, Pennsylvania, USA, August 2002.
17. D. Brauckhoff, B. Tellenbach, A. Wagner, M. May and A. Lakhina, "Impact of Packet Sampling on Anomaly Detection Metrics", Internet Measurement Conference 2006, Rio de Janeiro, Brazil, October 2006.
18. H. Wang, D. Zhang, K.G. Shin, "Change-Point Monitoring for the Detection of DoS Attacks", IEEE Transactions on Dependable and Secure Computing, Vol. 1, No. 4, pp. 193-208, 2004.