Detecting BGP anomalies with wavelet

NOMS 2008 - IEEE/IFIP Network Operations and Management Symposium: Pervasive Management for Ubiquitous Networks and Services

Volumn , Issue , 2008, Pages 465-472

  Mai, Jianning ^a   Yuan, Lihua ^a   Chuah, Chen Nee ^a  

^a UNIVERSITY OF CALIFORNIA   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

ANOMALOUS EVENTS; ANOMALY DETECTIONS; BGP MESSAGES; DATA SETS; NETWORK ANOMALY DETECTION; NETWORK OPERATIONS; QUANTITATIVE VALIDATIONS; ROOT CAUSE ANALYSIS; ROUTING TRAFFIC; SCALING PROPERTIES; SELF SIMILARITIES; SLAMMER WORMS; SPATIAL LOCALIZATION; UBIQUITOUS NETWORKS;

FINANCIAL DATA PROCESSING; TRAFFIC SIGNALS; UBIQUITOUS COMPUTING;

NETWORK MANAGEMENT;

EID: 51849083495     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/NOMS.2008.4575169     Document Type: Conference Paper

References (37)

1. C. Labovitz, G. R. Malan, and F. Jahanian, "Internet Routing Instability," in Proc. ACM SIGCOMM, Cannel, France, Sep 1997.
2. K. Varadhan, R. Govindan, and D. Estrin, "Persistent Route Oscillations in Inter-Domain Routing," IEEE/ACM Transactions on Networking, vol. 32, no. 1, 1999.
3. J. Cowie, A. Ogielski, B. Premore, and Y. Yuan, "Global Routing Instabilities during Code Red II and Nimda Worm Propagation , Preliminary Report," Renesys Corporation, Tech. Rep., Sep 2001. [Online]. Available: http://www.renesys.com/projects/bgp instability
4. L. Wang, X. Zhao, D. Pei, R. Bush, D. Massey, A. Mankin, S. F. Wu, and L. Zhang, "Observation and Analysis of BGP Behavior under Stress," in Proc. 2nd Internet Measurement Workshop, Marseille, France, Nov 2002. [Online]. Available: http://www.icir.org/vern/imw-2002/proceedings.html
5. A. Basu, C.-H. L. Ong, A. Rasala, F. B. Shepherd, and G. Wilfong, "Route Oscillations in I-BGP with Route Reflection," in Proc. ACM SIGCOMM, 2002.
6. R. Mahajan, D. Wetherall, and T. Anderson, "Understanding BGP Misconfiguration," in Proc. ACM SIGCOMM, Pittsburgh, PA, Aug 2002.
7. T. G. Griffin and G. Wilfong, "An Analysis of the MED Oscillation Problem in BGP," in ICNP, 2003.
8. M. Lad, X. Zhao, B. Zhang, D. Massey, and L. Zhang, "Analysis of BGP Update Burst during Slammer Attack," in Proceedings of the 5th International Workshop on Distributed Computing, Dec 2003.
9. A. Feldmann, O. Maennel, Z. M. Mao, A. Berger, and B. Maggs, "Locating Internet Routing Instabilities," in Proc. ACM SIGCOMM, Portland, Oregon, USA, Aug 2004.
10. J. Wu, Z. M. Mao, J. Rexford, and J. Wang, "Finding a needle in a haystack: pinpointing significant BGP routing changes in an IP network," in Proc. 2nd conference on Symposium on Networked Systems Design & Implementation (NSDI'05), Boston, MA, USA, May 2005.
11. "RIPE (Reeaux IP Europeens)," http://www.ripe.net/.
12. D. Meyer, "University of Oregon Route Views Project," http://www.routeviews.org/.
13. R. Mortier, http://mort.belltower.co.uk/pyrt.html.
14. P. Abry and D. Veitch, "Wavelet Analysis of Long Range Dependent Traffic," IEEE Transactions on Information Theory, vol. 44, no. 1, pp. 2-15, 1998. [Online]. Available: citeseer.nj.nec.com/abry98wavelet.html
15. B. Zhang, V. Kambhampati, M. Lad, D. Massey, and L. Zhang, "Identifying BGP Routing Table Transfers," in Sigcomm Workshop on mining network data (MineNet-05), Philadelphia, PA, USA, Aug 2005.
16. X. Zhao, D. Pei, L. Wang, D. Massey, A. Mankin, S. F. Wu, and L. Zhang, "An Analysis of BGP Multiple Origin AS (MOAS) Conflicts," in Proc. ACM SIGCOMM Internet Measurement Workshop, San Francisco, CA, USA, Nov 2001.
17. M. Lad, D. Massey, D. Pei, Y. Wu, B. Zhang, and L. Zhang, "PHAS: A Prefix Hijack Alert System," in Proc. 15th USENIX Security Symposium (Security 06), Vancouver, B.C., Canada, 2006.
18. S. Y. Qiu, F. Monrose, A. Terzis, and P. D. McDaniele, "Efficient Techniques for Detecting False Origin Advertisements in Inter-domain Routing," in Proc. 2nd IEEE Workshop on Secure Network Protocols, Santa Barbara, CA, USA, Nov 2006.
19. X. Hu and Z. M. Mao, "Accurate Real-time Identification of IP Prefix Hijacking," in Proc. 2007 IEEE Symposium on Security and Privacy, Oakland, California, USA, May 2007.
20. S. Teoh, K. Ma, S. Wu, and X. Zhao, "Information Visualization for Anomaly Detection," in Proceedings of 5th IASTED International Conference in Computer Graphics and Imaging (CGIM), Hawaii, 2002.
21. S. Teoh, K. Ma, S. Wu, D. Pei, L. Wang, L. Zhang, D. Massey, and R. Bush, "Visual-Based Anomaly Detection for BGP Origin AS Change (OASC) Events," in Proceedings of 14th IEEE/IFIP Workshop on Distributed Systems: Operations and Management (DSOM), vol. 2867, Heidelberg, Germany, Oct 2003.
22. K. Zhang, S. F. Wu, A. Yen, X. Zhang, and D. Massey, "On Detection of Anomalous Routing Dynamics in BGP," in Proc. IFIP Networking, 2004.
23. J. Zhang, J. Rexford, and J. Feigenbaum, "Learning-Based Anomaly Detection in BGP Updates," in Sigcomm Workshop on mining network data (MineNet-05), Philadelphia, PA, USA, Aug 2005.
24. K. Xu, J. Chandrashekar, and Z.-L. Zhang, "A First Step Toward Understanding Inter-Domain Routing Dynamics," in Sigcomm Workshop on mining network data (MineNet-05), Philadelphia, PA, USA, Aug 2005.
25. S. Deshpande, M. Thottan, T. Ho, and B. Sikdar, "A Statistical Approach to Anomaly Detection in Interdomain Routing," in Proc. BROADNETS'06, San Jose, CA, USA, October 2006.
26. Y. Huang, N. Feamster, A. Lakhina, and J. Xu, "Diagnosing Network Disruptions with Network-Wide Analysis," in Proc. ACM SIGMETRICS, San Diego, CA, USA, June 2007.
27. W. Leland, M. Willinger, and D. Wilson, "On the Self Similar nature of Ethernet Traffic (extended version)," IEEE/ACM Transactions on Networking, pp. 1-15, Feb 1994.
28. M. E. Crovella and A. Bestavros, "Self-Similarity in World Wide Web Traffic: Evidence and Possible Causes," IEEE/ACM Transactions on Networking, vol. 5, no. 6, pp. 835-846, Dec 1997.
29. L. Yuan, J. Mai, and C.-N. Chuah, "BGP Anomaly Detection Using Wavelet Analysis," Technical Report ECE-CE-2004-4, University of California, Davis, Tech. Rep., 2004.
30. G. Huston, "Measures of Self-Similarity of BGP Updates and Implications for Securing BGP," in Proc. The 8th Passive and Active Measurement (PAM'07), Louvain-la-neuve, Belgium, Apr 2007.
31. V. Alarcon-Aquino and J. A. Barria, "Anomaly detection in communication networks using wavelets," IEE Proceedings- Communications, vol. 148, no. 6, pp. 355-362, Dec 2001.
32. P. Barford, J. Kline, D. Plonka, and A. Ron, "A Signal Analysis of Network Traffic Anomalies," in Proc. ACM/SIGCOMM Internet Measurement Workshop, Marseille, France, Nov 2002.
33. Y. Xie, H.-A. Kim, D. R. O'Hallaron, M. K. Reiter, and H. Zhang, "Seurat: A Pointillist Approach to Anomaly Detection," in Proc. 7th International Symposium on Recent Advances in Intrusion Detection (RAID'07), Sophia Antipolis, French Riviera, France, Sep.
34. M. Thottan and C. Ji, "Anomaly Detection in IP Networks," in IEEE Transaction on Signal Processing, Special Issue of Signal Processing in Networking, vol. 51, no. 8, Aug 2003, pp. 2191-2204.
35. O. Maennel and A. Feldmann, "Realistic BGP Traffic for Test Labs," in Proceedings of ACM SIGCOMM 2002 Conference, Pittssburgh, PA, Aug 2002.
36. D. B. Percival and A. T. Walden, Wavelet Methods for Time Series Analysis. Cambridge University Press, 2004.
37. "Nanog mailing list," http://www.nanog.org.