The need for simulation in evaluating anomaly detectors

Computer Communication Review

Volumn 38, Issue 1, 2008, Pages 55-59

  Ringberg, Haakon ^a   Roughan, Matthew ^b   Rexford, Jennifer ^a  

^a PRINCETON UNIVERSITY   (United States)

^b UNIVERSITY OF ADELAIDE   (Australia)

Author keywords

[No Author keywords available]

Indexed keywords

ANOMALOUS EVENTS; ANOMALY DETECTOR; EVALUATION METHODOLOGIES; EVALUATION TECHNIQUES; NETWORK ANOMALY DETECTION; OPERATIONAL NETWORK; RIGOROUS EVALUATION; SURROUNDING ENVIRONMENT;

DETECTORS;

COMPUTER SIMULATION;

EID: 78650720508     PISSN: 01464833     EISSN: 01464833     Source Type: Conference Proceeding    
DOI: 10.1145/1341431.1341443     Document Type: Conference Paper

References (18)

1. BARFORD, P., KLINE, J., PLONKA, D., AND RON, A. A signal analysis of network traffic anomalies. In ACM Internet Measurement Workshop (Marseille, France, 2002).
2. ESTAN, C., SAVAGE, S., AND VARGHESE, G. Automatically inferring patterns of resource consumption in network traffic. In ACM SIGCOMM (Karlsruhe, Germany, 2003), pp. 137-148.
3. FLOYD, S., AND PAXSON, V. Difficulties in simulating the Internet. IEEE/ACM Transactions on Networking 9, 4(2001), 392-403.
4. HANLEY, J. A., AND MCNEIL, B. J. The meaning and use of the area under a receiver operating characteristic (ROC) curve. Radiology 143, 1(1982), 29-36.
5. HUANG, Y., FEAMSTER, N., LAKHINA, A., AND XU, J. J. Diagnosing network disruptions with network-wide analysis. In ACM SIGMETRICS (San Diego, CA, USA, 2007).
6. KOMPELLA, R. R., SINGH, S., AND VARGHESE, G. On scalable attack detection in the network. In ACM Internet Measurement Conference (New York, NY, USA, 2004), pp. 187-200.
7. KOTZ, D., AND HENDERSON, T. Crawdad: A community resource for archiving wireless data at Dartmouth. IEEE Pervasive Computing 04, 4(2005), 12-14.
8. LAKHINA, A., CROVELLA, M., AND DIOT, C. Diagnosing network-wide traffic anomalies. In ACM SIGCOMM (Portland, Oregon, USA, 2004), pp. 219-230.
9. LELAND, W. E., TAQQU, M. S., WILLINGER, W., AND WILSON, D. V. On the self-similar nature of Ethernet traffic (extended version). IEEE/ACM Transactions on Networking 2, 1 (Feb. 1994), 1-15.
10. RINGBERG, H., SOULE, A., AND REXFORD, J. WebClass: Adding rigor to manual labeling of traffic anomalies. SIGCOMM Comput. Commun. Rev. (2008).
11. RINGBERG, H., SOULE, A., REXFORD, J., AND DIOT, C. Sensitivity of PCA for traffic anomaly detection. In ACM SIGMETRICS (San Diego, CA, USA, 2007).
12. ROUGHAN, M., GREENBERG, A., KALMANEK, C., RUMSEWICZ, M., YATES, J., AND ZHANG, Y. Experience in measuring Internet backbone traffic variability: Models, metrics, measurements and meaning. In Proceedings of the International Teletraffic Congress (ITC-18) (Berlin, Germany, 2003), pp. 379-388.
13. SEKAR, V., DUFFIELD, N. G., SPATSCHECK, O., VAN DER MERWE, J. E., AND ZHANG, H. LADS: Large-scale automated DDoS detection system. In USENIX Technical Conference (2006), pp. 171-184.
14. SHANNON, C., MOORE, D., KEYS, K., FOMENKOV, M., HUFFAKER, B., AND K. CLAFFY. The Internet measurement data catalog. SIGCOMM Comput. Commun. Rev. 35, 5(2005), 97-100.
15. SOULE, A., SALAMATIAN, K., AND TAFT, N. Combining filtering and statistical methods for anomaly detection. In ACM Internet Measurement Conference (Berkeley, California, USA, October 2005).
16. ZHANG, Y., GE, Z., GREENBERG, A., AND ROUGHAN, M. Network anomography. In ACM Internet Measurement Conference (Berkeley, California, USA, October 2005).
17. ZHANG, Y., SINGH, S., SEN, S., DUFFIELD, N., AND LUND, C. Online identification of hierarchical heavy hitters: Algorithms, evaluation, and applications. In ACM Internet Measurement Conference (Taormina, Sicily, Italy, 2004), pp. 101-114.
18. ZOU, C. C., GAO, L., GONG, W., AND TOWSLEY, D. Monitoring and early warning for Internet worms. In Conference on Computer and Communications Security (New York, NY, USA, 2003), pp. 190-199.