Traffic anomaly detection at fine time scales with Bayes Nets

Proceedings - The 3rd International Conference on Internet Monitoring and Protection, ICIMP 2008

Volumn , Issue , 2008, Pages 37-46

  Kline, Jeff ^a   Nam, Sangnam ^a   Barford, Paul ^a   Plonka, David ^a   Ron, Amos ^a  

^a University of Wisconsin   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

BAYES NET; BIT RATES; BORDER ROUTERS; DETECTION ALGORITHMS; FALSE POSITIVES; HIGH-PRECISION; INGRESS/EGRESS; INPUT SIGNALS; INTERNATIONAL CONFERENCES; INTERNET MONITORING; MULTIPLE INPUTS; NETWORK OPERATORS; OPERATIONAL ENVIRONMENTS; PERFORMANCE MEASUREMENT SYSTEMS; TIME SCALING; TIME-SERIES; TIMESTAMPS; TRAFFIC ANOMALIES; TRAFFIC MEASUREMENTS; TRAFFIC VOLUMES;

CELLULAR RADIO SYSTEMS; ELECTRIC BREAKDOWN; FINANCIAL DATA PROCESSING; INDUSTRIAL MANAGEMENT; INTERNET; MARINE BIOLOGY; TIME SERIES ANALYSIS;

TRAFFIC SIGNALS;

EID: 51849118831     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ICIMP.2008.33     Document Type: Conference Paper

References (32)

1. J. Mirkovic, G. Prier, and P. Reiher, "Attacking DDoS at the Source," in Proceedings of 10th IEEE International Conference on Network Protocols, November 2002.
2. C. Kreitich, A. Warfield, J. Crowcroft ans S. Hand, and I. Pratt, "Using Packet Symmetry to Curtail Malicious Traffic," in Proceedings of ACM/USENIX Hotnets '05, College Park, MD, November 2005.
3. Endace Measurement Systems, "DAG Network Monitoring Interface Card," http://www.endace.com, 2005.
4. J. Brutlag, "Aberrant Behavior Detection in Time Series for Network Monitoring," in Proceedings of the USENIX Fourteenth System Administration Conference LISA XIV, New Orleans, LA, December 2000.
5. P. Barford, J. Kline, D. Plonka, and A. Ron, "A Signal Analysis of Network Traffic Anomalies," in Proceedings of ACM SIGCOMM Internet Measurement Workshop, Marseilles, France, November 2002.
6. Y. Zhang, Z. Ge, A. Greenberg, and M. Roughan, "Network Anomography," in Proceedings of ACM SIGCOMM Internet Measurement Conference '05, Brekeley, CA, October 2005.
7. C. Hood and C. Ji, "Proactive Network Fault Detection," in Proceedings of IEEE INFOCOM '97, Kobe, Japan, April 1997.
8. I. Katzela and M. Schwartz, "Schemes for Fault Identification in Communications Networks," IEEE/ACM Transactions on Networking, vol. 3(6), pp. 753-764, December 1995.
9. F. Feather, D. Siewiorek, and R. Maxion, "Fault Detection in an Ethernet Network Using Anomaly Signature Matching," in Proceedings of ACM SIGCOMM '93, San Francisco, CA, September 2000.
10. W. Lee and D. Xiang, "Information-theoretic Measures for Anomaly Detection," in Proceedings of IEEE Symposium on Security and Privacy, Brekeley, CA, May 2001.
11. Y. Gu, A. McCallum, and D. Towsley, "Detecting Anomalies in Network Traffic Using Maximum Entropy Estimation," in Proceedings of ACM SIGCOMM Internet Measurement Conference '05, Brekeley, CA, October 2005.
12. K. Xu, Z. Zhang, and S. Bhattacharya, "Profiling Internet Backbone Traffic: Behavior Models and Applications," in Proceedings of ACM SIGCOMM, Philadelphia, PA, August 2005.
13. Alfonso Valdes and Keith Skinner, "Adaptive, Model-Based Monitoring for Cyber Attack Detection," in RAID '00: Proceedings of the Third International Workshop on Recent Advances in Intrusion Detection, London, UK, 2000, pp. 80-92.
14. S. Staniford, J. Hoagland, and J. McAlemey, "Practical Automated Detection of Stealthy Portscans," IOS Press, vol. 10, pp. 105-136, 2002.
15. A. Lakhina, M. Crovella, and C. Diot, "Diagnosing Network-wide Traffic Anomalies," in Proceedings of ACM SIGCOMM '04, Portland, OR, August 2004.
16. A. Lakhina, M. Crovella, and C. Diot, "Characterization of Network-wide Anomalies in Traffic Flows," in Proceedings of ACM SIGCOMM Internet Measurement Conference '04, Taormina, Italy, October 2004.
17. A. Lakhina, M. Crovella, and C. Diot, "Mining Anomalies Using Traffic Feature Distributions," in Proceedings of ACM SIGCOMM '05, Philadelphia, PA, August 2005.
18. H. Ringberg, A. Soule, J. Rexford, and C. Diot, "Sensitivity of PCA for Traffic Anomaly Detection," in Proceedings of ACM SIGMETRICS, San Diego, CA, June 2007.
19. A. Soule, K. Salamatian, and N. Taft, "Combining Filtering and Statistical Methods for Anomaly Detection," in Proceedings of ACM SIGCOMM Internet Measurement Conference '05, Brekeley, CA, October 2005.
20. J. Terrell, K. Jeffay, F. Smith, L. Zhang, Z. Zhu, H. Shen, and A. Nobel, "Multivariate SVD Analyses for Network Anomaly Detection," in ACM SIGCOMM Poster Session, Philadelphia, PA, August 2005.
21. K. Lan and J. Heidemann, "On the Feasibility of Utilizing Correlations between User Populations for Traffic Inference," in Proceedings of IEEE Internation Conference on Local Computer Networks, Sydney, Australia, November 2005.
22. Y. Zhang, L. Breslau, V. Paxson, and S. Shenker, "On the Characteristics and Origins of Internet Flow Rates," in Proceedings of ACM SIGCOMM '02, Pittsburgh, PA, August 2002.
23. Sprint Labs, "IPMON Project," http://research.sprint.labs.com, 2005.
24. Nevil Brownlee, "NeTraMet beta versions," ftp://ftp.auckl.and. ac.nz/pub/iawg/NeTraMet/beta-versions/, 2005.
25. Tobi Oetiker, "RRDTool," http://oss.oetiker.ch/rrdtool/, 2005.
26. Tobi Oetiker, "MRTG," http://oss.oetiker.ch/mrtg/, 2005.
27. D. Plonka, "FlowScan: A. Network Traffic Flow Reporting and Visualization Tool," in Proceedings of the USENIX Fourteenth System Administration Conference (LISA XIV), New Orleans, LA, December 2000.
28. S. Kim, A. Reddy, and M. Vannucci, "Detecting Traffic Anomalies Through Aggregate Analysis of Packet Header Data," in Proceedings of Networking, Athens, Greece, May 2004.
29. V. Yegneswaran, P. Barford, and V. Paxson, "Using Honeynets for Internet Situational Awareness," in Proceedings of ACM/USENIX Workshop on Hot Topics in Networks (Hotnets IV), College Park, MD, November 2005.
30. I. Daubechies, Ten Lectures on Wavelets, CBMS NSF Reg. Conf. Series in Applied Math. SIAM, 1992.
31. S. Russel and P. Norvig, Artificial Intelligence: A Modern Approach, Prentice-Hall, Upper Saddle River, NJ, 1995.
32. A. Ward, P. Glynn, and K. Richardson, "Internet Service Performance Failure Detection," ACM SIGMETRICS Performance Evaluation Review, August 1998.