Flow anomaly detection in firewalled networks

2006 Securecomm and Workshops

Volumn , Issue , 2006, Pages

  Chapple, Michael J ^a   Wright, Timothy E ^a   Winding, Robert M ^a  

^a UNIVERSITY OF NOTRE DAME   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

ANOMALY DETECTION SYSTEM; ANOMALY DETECTIONS; CASE STUDIES; INTER QUARTILE RANGE; INTRUSION DETECTION SYSTEMS; NETWORK FLOW DATA; SIGNATURE DATABASES; STANDARD DEVIATION;

COMPUTER CRIME; DATA FLOW ANALYSIS; SENSORS; SIGNAL DETECTION; STANDARDS;

INTRUSION DETECTION;

EID: 50049109832     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SECCOMW.2006.359576     Document Type: Conference Paper

References (14)

1. Sourcefire, "The official snort ruleset and community rules," Website, http://www.snort.org.
2. J. D. Brutlag, "Aberrant behavior detection in time series for network monitoring," in LISA '00: Proceedings of the 14th USENIX Conference on System Administration. Berkeley, CA, USA: USENIX Association, 2000, pp. 139-146.
3. J. B. D. Cabrera, B. Ravichandran, and R. K. Mehra, "Statistical traffic modeling for network intrusion detection," in MASCOTS '00: Proceedings of the 8th International Symposium on Modeling, Analysis and Simulation of Computer and Telecommunication Systems. Washington, DC, USA: IEEE Computer Society, 2000, p. 466.
4. M. Zissman, "1998 darpa intrusion detection evaluation dataset," Website, http://www.ll.mit.edu/IST/ideval/docs/docs_index.html.
5. M.-S. Kim, H.-J. Kang, S.-C. Hong, S.-H. Chung, and J. W. Hong, "A flow-based method for abnormal network traffic detection," in Proceedings of the IEEE/IFIP Network Operations and Management Symposium. IEEE, 2004.
6. T.-L. Pai and P.-W. Wang, "Netflow based intrusion detection system," in Proceedings of the 2004 IEEE International Conference on Networking, Sensing and Control. IEEE, 2004, pp. 731-736.
7. P. Barford, J. Kline, D. Plonka, and A. Ron, "A signal analysis of network traffic anomalies," in IMW '02: Proceedings of the 2nd ACM SIGCOMM Workshop on Internet Measurment. New York, NY, USA: ACM Press, 2002, pp. 71-82.
8. A. Lakhina, K. Papagiannaki, M. Crovella, C. Diot, E. D. Kolaczyk, and N. Taft, "Structural analysis of network traffic flows," in SIGMETRICS 2004/PERFORMANCE 2004: Proceedings of the Joint International Conference on Measurement and Modeling of Computer Systems. New York, NY, USA: ACM Press, 2004, pp. 61-72.
9. A. Lakhina, M. Crovella, and C. Diot, "Mining anomalies using traffic feature distributions," in SIGCOMM '05: Proceedings of the 2005 Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications. New York, NY, USA: ACM Press, 2005, pp. 217-228.
10. R. Schweller, A. Gupta, E. Parsons, and Y. Chen, "Reversible sketches for efficient and accurate change detection over network data streams," in IMC '04: Proceedings of the 4th ACM SIGCOMM Conference on Internet Measurement. New York, NY, USA: ACM Press, 2004, pp. 207-212.
11. L. Gaspary, C. Melchiors, F. Locatelli, and F. Dillenburg, "Identification of intrusion scenarios through classification, characterization and analysis of firewall events," in Proceedings of the IEEE Conference on Local Computer Networks. IEEE, 2004.
12. M. Kenney, "Ping of death," Website, http://www.insecure.org/ sploits/ping-o-death.html.
13. "Testing intrusion detection systems: A critique of the 1998 and 1999 darpa intrusion detection system evaluations as performed by lincoln laboratory," ACM Trans. Inf. Syst. Secur., vol. 3, no. 4, pp. 262-294, 2000.
14. P. Mell, V. Hu, R. Lippmann, J. Haines, and M. Zissman, "An overview of issues in testing intrusion detection systems," 2003, nIST IR 7046.