On the use of sketches and wavelet analysis for network anomaly detection

IWCMC 2010 - Proceedings of the 6th International Wireless Communications and Mobile Computing Conference

Volumn , Issue , 2010, Pages 331-335

  Callegari, Christian ^a   Giordano, Stefano ^a   Pagano, Michele ^a   Pepe, Teresa ^a  

^a UNIVERSITY OF PISA   (Italy)

Author keywords

Anomaly detection; K L divergence; Multi time scale; PCA

Indexed keywords

ANOMALY DETECTION; IN-NETWORK; INTRUSION DETECTION SYSTEMS; KEY ELEMENTS; NETWORK ANOMALIES; NETWORK ANOMALY DETECTION; NOVEL TECHNIQUES; PERFORMANCE ANALYSIS; SECURITY ATTACKS; TIME-SCALES;

COMPUTER CRIME; INTRUSION DETECTION; MOBILE COMPUTING; WAVELET ANALYSIS; WAVELET TRANSFORMS; WIRELESS TELECOMMUNICATION SYSTEMS;

NETWORK SECURITY;

EID: 77955131278     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1815396.1815473     Document Type: Conference Paper

References (13)

1. Flow-Tools Home Page. http://www.ietf.org/rfc/rfc3954.txt.
2. The Internet2 Network. http://www.internet2.edu/network/.
3. P. Barford, J. Kline, D. Plonka, and A. Ron. A signal analysis of network traffic anomalies. In IMW '02: Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurment, pages 71-82, 2002.
4. B. Claise. Cisco Systems NetFlow Services Export Version 9. RFC 3954 (Informational), Oct. 2004.
5. G. Cormode and S. Muthukrishnan. An improved data stream summary: the count-min sketch and its applications. Journal of Algorithms, 55(1):58-75, 2005.
6. A. Dainotti, A. Pescape', and G. Ventre. Wavelet-based detection of dos attacks. In Proceedings of Global Telecommunications Conference 2006. GLOBECOM '06. IEEE, pages 1-6, 2006.
7. I. Daubechies. Ten lectures on Wavelets. no.61 in CBMS-NSF Series in Applied Mathematics. SIAM, Philadelphia, 1992.
8. G. Dewaele, K. Fukuda, P. Borgnat, P. Abry, and K. Cho. Extracting hidden anomalies using sketch and non gaussian multiresolution statistical detection procedures. In LSAD '07: Proceedings of the 2007 workshop on Large scale attack defense, pages 145-152, New York, NY, USA, 2007. ACM.
9. P. Huang, A. Feldmann, and W. Willinger. A non-instrusive, wavelet-based approach to detecting network performance problems. In IMW '01: Proceedings of the 1st ACM SIGCOMM Workshop on Internet Measurement, pages 213-227, 2001.
10. A. Lakhina, M. Crovella, and C. Diot. Mining anomalies using traffic feature distributions. SIGCOMM Comput. Commun. Rev., 35(4):217-228, 2005.
11. S. Mallat. Multifrequency channel decompositions of images and wavelet models. IEEE Transactions on Acoustics, Speech and Signal Processing, 37(12):2091-2110, Dec. 1989.
12. C.-M.-C. Pascal and C. Fabrice. Finding hierarchical heavy hitters with the count min sketch. In Proceedings of 4th International Workshop on Internet Performance, Simulation, Monitoring and Measurement, IPS-MOME, 2006.
13. M. Thorup and Y. Zhang. Tabulation based 4-universal hashing with applications to second moment estimation. In SODA '04: Proceedings of the fifteenth annual ACM-SIAM symposium on Discrete algorithms, pages 615-624, Philadelphia, PA, USA, 2004. Society for Industrial and Applied Mathematics.