Impact of traffic mix and packet sampling on anomaly visibility

Proceedings - The 3rd International Conference on Internet Monitoring and Protection, ICIMP 2008

Volumn , Issue , 2008, Pages 31-36

  Tellenbach, Bernhard ^a   Brauckhoff, Daniela ^a   May, Martin ^a  

^a ETH ZURICH   (Switzerland)

Author keywords

[No Author keywords available]

Indexed keywords

COMPUTER CRIME; ELECTRIC BREAKDOWN; FINANCIAL DATA PROCESSING; INTERNET; INTERNET SERVICE PROVIDERS; OPTICAL PROPERTIES; VISIBILITY;

BORDER ROUTERS; INTERNATIONAL CONFERENCES; INTERNET MONITORING; MEDIUM SIZE; NET FLOWS; NETWORK TRAFFICS; NETWORKING INFRASTRUCTURES; PACKET SAMPLING; SAMPLING RATES; TRAFFIC MIX;

SAMPLING;

EID: 51849125142     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ICIMP.2008.18     Document Type: Conference Paper

References (15)

1. BRAUCKHOFF, D., TELLENBACH, B., WAGNER, A., MAY, M., AND LAKHINA, A. Impact of packet sampling on anomaly detection metrics. In IMC '06: Proceedings of the 6th ACM SIGCOMM on Internet measurement (New York, NY, USA, 2006), ACM Press, pp. 159-164.
2. CHOI, B.-Y., PARK, J., AND ZHANG, Z.-L. Adaptive random, sampling for total load estimation. In In proceedings of the IEEE International Conference on Communications (ICC'03) (2003).
3. Cisco NetFlow. At www.cisco.com.
4. DUFFIELD, N., LUND, C., AND THORUP, M. Properties and prediction of flow statistics from sampled packet streams. In ACM SIGCOMM Internet Measurment Workshop (2002).
5. DUFFIELD, N., LUND, C., AND THORUP, M. Estimating Flow Distributions from Sampled Flow Statistics. In ACM SIGCOMM (Karlsrahe, August 2003).
6. HOHN, N., AND VEITCH, D. Inverting Sampled Traffic. In Internet Measurement Conference (Miami, October 2003).
7. JUNG, J., PAXSON, V., BERGER, A., AND BALAKRISHNAN, H. Fast portscan detection using sequential hypothesis testing, 2004.
8. KIM, M.-S., KANG, H.-J., HUNG, S.-C., CHUNG, S.-H., AND HONG, J. W. A Flow-based Method for Abnormal Network Traffic Detection. In IEEE/IFIP Network Operations and Management Symposium (Seoul, April 2004).
9. LAKHINA, A., CROVELLA, M., AND DIOT, C. Mining Anomalies Using Traffic Feature Distributions. In ACM SIGCOMM (Philadelphia, August 2005).
10. MAI, J., CHUAH, C.-N., SRIDHARAN, A., YE, T., AND ZANG, H. IS sampled data sufficient for anomaly detection? In IMC 2006 (To appear) (Rio de Janeiro, Brazil, October 2006).
11. MAI, J., SRIDHARAN, A., CHUAH, C.-N., ZANG, H., AND YE, T. Impact of packet sampling on portscan detection. IEEE Journal on Selected Areas of Communications 24, 12 (2006), 2285-2298.
12. SOULE, A., RINGBERG, H., SILVEIRA, F., REXFORD, J., AND DIOT, C. Detectability of traffic anomalies in two adjacent networks. In Passive and Active Measurement Conference (PAM) (Louvain-la-Neuve, Belgium, 2007).
13. SRIDHARAN, A., YE, T., AND BHATTACHARRYA, S. Connectionless port scan detection on the backbone. In Malware workshop, held in conjunction with IPCCC (Pheonix, AZ, April 2006).
14. TELLENBACH, B., BRAUCKHOFF, D., AND MAY, M. Impact of traffic mix and packet sampling on anomaly visibility. Tech. rep., ETH Zurich, April 2007.
15. XI, K., ZHANG, Z.-L., AND B HATTACHARRYA, S. Profiling internet backbone traffic: Behavior models and applications. In ACM Sigcomm 2005 (Philadelphia, PA, August 2005).