Anomaly extraction in backbone networks using association rules

Proceedings of the ACM SIGCOMM Internet Measurement Conference, IMC

Volumn , Issue , 2009, Pages 28-34

  Brauckhoff, Daniela ^a   Dimitropoulos, Xenofontas ^a   Wagner, Arno ^a   Salamatian, Kavè ^b  

^a ETH ZURICH   (Switzerland)

^b LANCASTER UNIVERSITY   (United Kingdom)

Author keywords

Anomaly extraction; Association rules; Histogram cloning

Indexed keywords

ANOMALOUS EVENTS; ANOMALY DETECTION; ANOMALY DETECTOR; BACK-BONE NETWORK; FALSE POSITIVE; ORDERS OF MAGNITUDE; ROOT CAUSE ANALYSIS; TRAFFIC DATA;

ASSOCIATION RULES; GENETIC ENGINEERING; GRAPHIC METHODS;

EXTRACTION;

EID: 77956376882     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1644893.1644897     Document Type: Conference Paper

References (23)

1. R. Agrawal and R. Srikant. Fast algorithms for mining association rules in large databases. In VLDB'94, Proceedings of 20th International Conference on Very Large Data Bases, September 12-15, 1994, Santiago de Chile, Chile, pages 487-499. Morgan Kaufmann, 1994.
2. P. Barford, J. Kline, D. Plonka, and A. Ron. A signal analysis of network traffic anomalies. In IMW '02: Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurment, pages 71-82, New York, NY, USA, 2002. ACM Press.
3. D. Brauckhoff, X. Dimitropoulos, A. Wagner, and K. Salamatian. Anomaly extraction in backbone networks using association rules. TIK-Report 309, .
4. D. Brauckhoff, M. May, and K. Salamatian. Applying PCA for Traffic Anomaly Detection: Problems and Solutions. In IEEE INFOCOM Mini Conference, 2009.
5. V. Chandola and V. Kumar. Summarization - compressing data into an informative representation. Knowl. Inf. Syst., 12:355-378, 2007.
6. G. Cormode, F. Korn, S. Muthukrishnan, and D. Srivastava. Finding hierarchical heavy hitters in streaming data. ACM Trans. Knowl. Discov. Data, 1(4):1-48, 2008.
7. G. Dewaele, K. Fukuda, P. Borgnat, P. Abry, and K. Cho. Extracting hidden anomalies using sketch and non gaussian multiresolution statistical detection procedures. In LSAD '07: Proceedings of the 2007 workshop on Large scale attack defense, pages 145-152, New York, NY, USA, 2007. ACM Press.
8. C. Estan, S. Savage, and G. Varghese. Automatically inferring patterns of resource consumption in network traffic. In SIGCOMM '03: Proceedings of the 2003 conference on Applications, technologies, architectures, and protocols for computer communications, pages 137-148, New York, NY, USA, 2003. ACM Press.
9. Y. Gu, A. McCallum, and D. Towsley. Detecting anomalies in network traffic using maximum entropy estimation. In IMC '05: Proceedings of the 5th ACM SIGCOMM conference on Internet Measurement, pages 32-32, Berkeley, CA, USA, 2005. USENIX Association.
10. S. Kandula, R. Chandra, and D. Katabi. What's going on?: learning communication rules in edge networks. In SIGCOMM, pages 87-98, 2008.
11. A. Kind, M. P. Stoecklin, and X. Dimitropoulos. Histogram-based traffic anomaly detection. IEEE Transactions on Network and Service Management, to appear, 2009.
12. B. Krishnamurthy, S. Sen, Y. Zhang, and Y. Chen. Sketch-based change detection: methods, evaluation, and applications. In IMC '03: Proceedings of the 3rd ACM SIGCOMM conference on Internet measurement, pages 234-247, New York, NY, USA, 2003. ACM Press.
13. A. Lakhina, M. Crovella, and C. Diot. Diagnosing network-wide traffic anomalies. In SIGCOMM '04: Proceedings of the 2004 conference on Applications, technologies, architectures, and protocols for computer communications, pages 219-230, New York, NY, USA, 2004. ACM Press.
14. A. Lakhina, M. Crovella, and C. Diot. Mining anomalies using traffic feature distributions. In SIGCOMM '05: Proceedings of the 2005 conference on Applications, technologies, architectures, and protocols for computer communications, pages 217-228, New York, NY, USA, 2005. ACM.
15. X. Li, F. Bian, M. Crovella, C. Diot, R. Govindan, G. Iannaccone, and A. Lakhina. Detection and identification of network anomalies using sketch subspaces. In IMC '06: Proceedings of the 6th ACM SIGCOMM conference on Internet measurement, pages 147-152, New York, NY, USA, 2006. ACM.
16. M. V. Mahoney and P. K. Chan. Learning rules for anomaly detection of hostile network traffic. In ICDM '03: Proceedings of the Third IEEE International Conference on Data Mining, pages 601-604, Washington, DC, USA, 2003. IEEE Computer Society.
17. J. McHugh. Testing intrusion detection systems: a critique of the 1998 and 1999 darpa intrusion detection system evaluations as performed by lincoln laboratory. ACM Trans. Inf. Syst. Secur., 3:262-294, 2000.
18. K. H. Ramah, K. Salamatian, and F. Kamoun. Scan surveillance in internet networks. In Networking, pages 614-625, 2009.
19. S. Ranjan, S. Shah, A. Nucci, M. M. Munafò, R. L. Cruz, and S. M. Muthukrishnan. Dowitcher: Effective worm detection and containment in the internet core. In INFOCOM, pages 2541-2545, 2007.
20. A. Soule, K. Salamatian, and N. Taft. Combining filtering and statistical methods for anomaly detection. In IMC'05: Proceedings of the 5th Conference on Internet Measurement 2005, Berkeley, California, USA, October 19-21, 2005, pages 331-344. USENIX Association, 2005.
21. M. P. Stoecklin, J.-Y. L. Boudec, and A. Kind. A two-layered anomaly detection technique based on multi-modal flow behavior models. In PAM: Proceedings of 9th International Conference on Passive and Active Measurement, Lecture Notes in Computer Science, pages 212-221. Springer, 2008.
22. A. Wagner and B. Plattner. Entropy based worm and anomaly detection in fast ip networks. In WETICE '05: Proceedings of the 14th IEEE International Workshops on Enabling Technologies: Infrastructure for Collaborative Enterprise, pages 172-177, Washington, DC, USA, 2005. IEEE Computer Society.
23. Y. Zhang, S. Singh, S. Sen, N. Duffield, and C. Lund. Online identification of hierarchical heavy hitters: algorithms, evaluation, and applications. In IMC '04: Proceedings of the 4th ACM SIGCOMM conference on Internet measurement, pages 101-114, New York, NY, USA, 2004. ACM.ETH Zurich, September 2009.