Network anomaly detection and classification via opportunistic sampling

IEEE Network

Volumn 23, Issue 1, 2009, Pages 6-12

  Androulidakis, Georgios ^a   Chatzigiannakis, Vassius ^a   Papavassiliou, Symeon ^b  

^a NATIONAL TECHNICAL UNIVERSITY OF ATHENS   (Greece)

^b NATIONAL TECHNICAL UNIVERSITY OF ATHENS NTUA   (Greece)

Author keywords

Data mining; Entropy; Grippers; IP networks; Probability density function; Sampling methods; Web server

Indexed keywords

ANOMALY DETECTION METHODS; ANOMALY DETECTIONS; IP NETWORKS; NETWORK ANOMALIES; NETWORK ANOMALY DETECTIONS; SAMPLED DATUM; SAMPLING METHODS; SAMPLING PROCESS; SAMPLING TECHNIQUES; TRAFFIC DATUM; UNIVERSITY CAMPUS; WEB SERVER;

ENTROPY; GRIPPERS; INFORMATION MANAGEMENT; INTERNET PROTOCOLS; WEB SERVICES;

PROBABILITY DENSITY FUNCTION;

EID: 65249118227     PISSN: 08908044     EISSN: None     Source Type: Journal    
DOI: 10.1109/MNET.2009.4804318     Document Type: Article

References (17)

1. P. Barford and D. Plonka, "Characteristics of Network Traffic Flow Anomalies," Proc. 1st ACM SIGCOMM Internet Measurement Wksp., San Francisco, CA, Nov. 2001, pp. 69-74.
2. J. Mai et al., "Impact of Packet Sampling on Portscan Detection," IEEE JSAC, vol. 24, no 12, 2006, pp. 2285-98.
3. J. Mai et al., "Is Sampled Data Sufficient for Anomaly Detection?," Internet Measurement Conf. '06, Rio de Janeiro, Brazil, Oct. 2006.
4. D. Brauckhoff et al., "Impact of Packet Sampling on Anomaly Detection Metrics," Internet Measurement Conf. '06, Rio de Janeiro, Brazil, Oct. 2006.
5. J. Mirkovic and P. Reiher, "A Taxonomy of DDoS Attack and DDoS Defense Mechanisms," ACM SIGCOMM Comp. Commun. Rev., vol. 34, no. 2, Apr. 2004, pp. 39-53.
6. S. Chen and S. Ranka, "Detecting Internet Worms at Early Stage," IEEE JSAC, vol. 23, no. 10, Oct. 2005, pp. 2003-12.
7. A. Sridharan, T. Ye, and S. Bhattacharyya, "Connectionless Port Scan Detection on the Backbone," Malware Wksp., IEEE IPCCC '06, Phoenix, AZ, Apr. 2006.
8. I. Ari et al., "Managing Flash Crowds on the Internet," Proc. MASCOTS '03, Orlando, FL, Oct. 2003, pp. 246-49.
9. S. Sarvotham, R. Riedi, and R. Baraniuk, "Connection-Level Analysis and Modeling of Network Traffic," Proc. 1st ACM SIGCOMM Wksp. Internet Measurement, San Diego, CA, Nov. 2001.
10. N. Hohn and D. Veitch, "Inverting Sampled Traffic," Proc. 3rd ACM SIGCOMM Wksp. Internet Measurement, Miami, FL, 2003, pp. 222-33.
11. N. Duffield, C. Lund, and M. Thorup, "Estimating Flow Distributions From Sampled Flow Statistics," IEEE/ACM Trans. Net., vol. 13, no. 5, 2005, pp. 933-46.
12. B.Y. Choi, J. Park, and Z.L. Zhang, "Adaptive Packet Sampling for Accurate and Scalable Flow Measurement," IEEE GLOBECOM '04, Dallas, TX, Nov. 2004, pp. 1448-52.
13. G. Androulidakis and S. Papavassiliou, "Improving Network Anomaly Detection via Selective Flow-based Sampling," IET Commun. J., vol. 2, no. 3, Mar. 2008.
14. N. G. Duffield and C. Lund, "Predicting Resource Usage and Estimation Accuracy in an IP Flow Measurement Collection Infrastructure," ACM SIGCOMM Internet Measurement Conf. '03, Miami Beach, FL, Oct. 27-29, 2003.
15. S. Ranjan et al., "DoWitcher: Effective Worm Detection and Containment in the Internet Core," IEEE INFOCOM '07, Anchorage, AK, May 2007, pp. 2541-45.
16. D. Moore et al., "Inside the Slammer Worm," IEEE Sec. & Privacy, vol. 1, no. 4, July-Aug. 2003, pp. 33-39.
17. L. Yang and G. Michailidis, "Sampled Based Estimation of Network Traffic Flow Characteristics," IEEE INFOCOM '07), Anchorage, AK, May 2007, pp. 1775-83.