A wavelet-based anomaly detection for outbound network traffic

8th Asia-Pacific Symposium on Information and Telecommunication Technologies, APSITT 2010

Volumn , Issue , 2010, Pages

  Limthong, Kriangkrai ^a   Watanapongse, Pirawat ^b   Fukuda, Kensuke ^c  

^a GRADUATE UNIVERSITY FOR ADVANCED STUDIES   (Japan)

^b KASETSART UNIVERSITY   (Thailand)

^c NATIONAL INSTITUTE OF INFORMATICS   (Japan)

Author keywords

Anomaly detection; Network traffic; Outbound; Statistical distance; Time series; Wavelet

Indexed keywords

ANOMALY DETECTION; NETWORK TRAFFIC; OUTBOUND; STATISTICAL DISTANCE; WAVELET;

TIME SERIES; TRANSMISSION CONTROL PROTOCOL; WAVELET ANALYSIS;

INTERNET PROTOCOLS;

EID: 77956471727     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (19)

1. J. D. Brutlag, "Aberrant behavior detection in time series for network monitoring, " in LISA '00: Proceedings of the 14th USENIX conference on System administration. Berkeley, CA, USA: USENIX Association, 2000, pp. 139-146.
2. C.-M. Cheng, H. Kung, and K.-S. Tan, "Use of spectral analysis in defense against dos attacks, " in Global Telecommunications Conference, 2002. GLOBECOM '02. IEEE, vol. 3, Nov. 2002, pp. 2143-2148 vol.3.
3. M. Thottan and C. Ji, "Anomaly detection in ip networks, " Signal Processing, IEEE Transactions on, vol.51, no.8, pp. 2191-2204, Aug. 2003.
4. Y. Chen and K. Hwang, "Spectral analysis of tcp flows for defense against reduction-of-quality attacks, " in Communications, 2007. ICC '07. IEEE International Conference on, June 2007, pp. 1203-1210.
5. Y. Gu, A. McCallum, and D. Towsley, "Detecting anomalies in network traffic using maximum entropy estimation, " in IMC '05: Proceedings of the 5th ACM SIGCOMM conference on Internet Measurement. Berkeley, CA, USA: USENIX Association, 2005, pp. 32-32
6. A. Wagner and B. Plattner, "Entropy based worm and anomaly detection in fast ip networks, " in Enabling Technologies: Infrastructure for Collaborative Enterprise, 2005. 14th IEEE International Workshops on, June 2005, pp. 172-177.
7. A. Lakhina, M. Crovella, and C. Diot, "Diagnosing network-wide traffic anomalies, " in SIGCOMM '04: Proceedings of the 2004 conference on Applications, technologies, architectures, and protocols for computer communications. New York, NY, USA: ACM, 2004, pp. 219-230.
8. B. I. P. Rubinstein, B. Nelson, L. Huang, A. D. Joseph, S.-h. Lau, N. Taft, and D. Tygar, "Compromising pca-based anomaly detectors for network- wide traffic, " EECS Department, University of California, Berkeley, Tech. Rep. UCB/EECS-2008-2073, May 2008. [Online]. Available: http://www.eecs. berkeley.edu/Pubs/TechRpts/2008/EECS-2008-73.html
9. H Ringberg, A Soule, J Rexford, and C Diot, "Sensitivity of pca for traffic anomaly detection, " SIGMETRICS Perform. Eval. Rev., vol.35, no.1, pp. 109-120, 2007.
10. P. Huang, A. Feldmann, and W. Willinger, "A non-instrusive, wavelet- based approach to detecting network performance problems, " in IMW '01: Proceedings of the 1st ACM SIGCOMM Workshop on Internet Measurement. New York, NY, USA: ACM, 2001, pp. 213-227.
11. P. Barford, J. Kline, D. Plonka, and A. Ron, "A signal analysis of network traffic anomalies, " in IMW '02: Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurment. New York, NY, USA: ACM, 2002, pp. 71-82.
12. W. Lu and A. A. Ghorbani, "Network anomaly detection based on wavelet analysis, " EURASIP J. Adv. Signal Process, vol.2009, pp. 1-16, 2009.
13. L. Li and G. Lee, "Ddos attack detection and wavelets, " in Computer Communications and Networks, 2003. ICCCN 2003. Proceedings. The 12th International Conference on, Oct. 2003, pp. 421-427.
14. A. Dainotti, A. Pescape, and G. Ventre, "Nis04-1: Wavelet-based detection of dos attacks, " in Global Telecommunications Conference, 2006. GLOBECOM '06. IEEE, 27 2006-Dec. 1 2006, pp. 1-6.
15. K. Limthong, F. Kensuke, and P. Watanapongse, "Wavelet-based unwanted traffic time series analysis, " in Computer and Electrical Engineering, 2008. ICCEE 2008. International Conference on, Dec. 2008, pp. 445-449.
16. A. Magnaghi, T. Hamada, and T. Katsuyama, "A wavelet-based framework for proactive detection of network misconfigurations, " in NetT '04: Proceedings of the ACM SIGCOMM workshop on Network troubleshooting. New York, NY, USA: ACM, 2004, pp. 253-258.
17. J. Mirkovic and P. Reiher, "D-ward: a source-end defense against flooding denial-of-service attacks, " Dependable and Secure Computing, IEEE Transactions on, vol.2, no.3, pp. 216-232, July-Sept. 2005.
18. V. A. Siris and F. Papagalou, "Application of anomaly detection algorithms for detecting syn flooding attacks, " Computer Communications, vol.29, no.9, pp. 1433 - 1442, 2006, iCON 2004 - 12th IEEE International Conference on Network 2004.
19. A. Tartakovsky, B. Rozovskii, R. Blazek, and H. Kim, "A novel approach to detection of intrusions in computer networks via adaptive sequential and batch-sequential change-point detection methods, " Signal Processing, IEEE Transactions on, vol.54, no.9, pp. 3372-3382, Sept. 2006.