Unsupervised ensemble anomaly detection through time-periodical packet sampling

Proceedings - IEEE INFOCOM

Volumn , Issue , 2010, Pages

  Nawata, Shuichi ^a   Uchida, Masato ^a   Gu, Yu ^b   Tsuru, Masato ^a   Oie, Yuji ^a  

^a KYUSHU INSTITUTE OF TECHNOLOGY   (Japan)

^b NEC LABORATORIES AMERICA   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

ANOMALY DETECTION; ANOMALY DETECTION METHODS; BASELINE MODELS; CONVENTIONAL METHODS; FALSE NEGATIVE RATE; FALSE POSITIVE; LOSSY NATURE; NETWORK TRAFFIC; NORMAL BEHAVIOR; PACKET SAMPLING; PERFORMANCE VARIATIONS; REAL TRAFFIC; TRAFFIC DATA;

RAILROAD CARS;

LOCOMOTIVES;

EID: 77953880481     PISSN: 0743166X     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/INFCOMW.2010.5466662     Document Type: Conference Paper

References (31)

1. J. M. Estevez-Tapiador, P. Garcia-Teodoro, and J. E. Diaz-Verdejo, "Anomaly detection methods in wired networks: A survey and taxonomy," Computer Communications, vol. 27, no. 16, October 2004.
2. A. Patcha and J. Park, "An overview of anomaly detection techniques: Existing solutions and latest technological trends," Computer Networks, vol. 51, no. 12, August 2007.
3. "Worldwide Infrastructure Security Report," http://www.arbornetworks.com/report, October 2010.
4. "2008 CSI Computer Crime and Security Survey," http://i.cmpnet.com/v2.gocsi.com/pdf/CSIsurvey2008.pdf.
5. "2010 CyberSecurity Watch Survey - Survey Results," http://www.cert.org/archive/pdf/ecrimesummary10.pdf.
6. "Defending TCP Against Spoofing Attacks (RFC 4935)," http://tools.ietf.org/html/rfc4953.
7. "InMon sFlow Probe," http://www.inmon.com/technology/index.php.
8. "Cisco NetFlow," http://www.cisco.com/web/go/netflow.
9. "A Framework for Packet Selection and Reporting (RFC 5474)," http://tools.ietf.org/html/rfc5474.
10. "Snort," http://www.snort.org.
11. "Bro," http://bro-ids.org.
12. V. A. Siris and F. Papagalou, "Application of anomaly detection algorithms for detecting syn flooding attacks," Computer Communications, vol. 29, no. 9, pp. 1433-1442, May 2006.
13. H. Wang, D. Zhang, and K. G. Shin, "Change-point monitoring for the detection of dos attacks," IEEE Transactions on Dependable and Secure Computing, vol. 1, no. 4, pp. 193-208, October 2004.
14. P. Barford, J. Kline, D. Plonka, and A. Ron, "A signal analysis of network traffic anomalies," in Proceedings of the 2nd ACM SIGCOMM Workshop on Internet Measurment (IMW 2002), France, November 2002, pp. 71-82.
15. Y. Gu, A. McCallum, and D. Towsley, "Detecting anomalies in network traffic using entropy estimation," in Proceedings of the 5th ACM SIGCOMM Conference on Internet Measurement (IMC 2005), Berkeley, CA, USA, October 2005, pp. 345-350.
16. S. Shanbhag and T. Wolf, "Accurate anomaly detection through parallelism," IEEE Network, vol. 23, no. 1, pp. 22-28, January/February 2009.
17. A. Lakhina, M. Crovella, and C. Diot, "Mining anomalies using traffic feature distributions," ACM SIGCOMM Computer Communication Review, vol. 35, no. 4, pp. 217-228, October 2005.
18. N. Duffield, "Sampling for passive internet measurement: A review," Statistical Science, vol. 19, no. 3, pp. 472-498, 2004.
19. N. Duffield, C. Lund, and M. Thorup, "Estimating flow distributions from sampled flow statistics," IEEE/ACM Transactions on Networking, vol. 13, no. 5, pp. 933-946, October 2005.
20. S. Itou, K. Uchiyama, and S. Shioda, "Fixed-period packet sampling and its application to flow rate estimation," in Proceedings of the IEEE International Conference on Communications (ICC 2007), Glasgow, Scotland, June 2007, pp. 279-286.
21. T. Mori, T. Takine, J. Pan, R. Kawahara, M. Uchida, and S. Goto, "Identifying heavy-hitter flows from sampled flow statistics," IEICE Transactions on Communications, vol. E90-B, no. 11, pp. 3061-3072, November 2007.
22. D. Brauckhoff, B. Tellenbach, A. Wagner, M. May, and A. Lakhina, "Impact of packet sampling on anomaly detection metrics," in Proceedings of the 6th ACM SIGCOMM Conference on Internet Measurement (IMC 2006), Rio de Janeriro, Brazil, October 2006, pp. 159-164.
23. J. Mai, A. Sridharan, C. Chuah, H. Zang, and T. Ye, "Impact of packet sampling on portscan detection," IEEE Journal on Selected Areas in Communications, vol. 24, no. 12, December 2006.
24. G. Androulidakis, V. Chatzigiannakis, and S. Papavassiliou, "Network anomaly detection and classification via opportunistic sampling," IEEE Network, vol. 23, no. 1, pp. 6-12, January/February 2009.
25. K. C. Claffy, G. C. Polyzos, and H.-W. Braun, "Application of sampling methodologies to network traffic characterization," ACM SIGCOMM Computer Communication Review, vol. 23, no. 4, pp. 194-203, October 1993.
26. K. Lan, A. Hussain, and D. Dutta, "The effect of malicious traffic on the network," in Proceedings of the Passive and Active Measurement Workshop (PAM 2003), San Diego, CA, USA, April 2003, pp. 159-164.
27. L. Breiman, "Bagging predictors," Machine Learning, vol. 24, no. 2, pp. 123-140, August 1996.
28. R. E. Schapire, "The strength of weak learnability," Machine Learning, vol. 5, no. 2, pp. 197-227, June 1990.
29. M. Uchida and H. Shioya, "A study on an extended formula of divergence measures using invariance," Electronics and Communications in Japan (Part 3: Fundamental Electronic Science), vol. 88, no. 4, pp. 35-42, December 2004.
30. M. Uchida, Y. Maehara, and H. Shioya, "Design of an unsupervised weight parameter estimation method in ensemble learning," Lecture Notes in Computer Science, vol. 4984, pp. 771-780, June 2008.
31. "UMass Trace Repository," http://traces.cs.umass.edu/.