Network-aware behavior clustering of Internet end hosts

Proceedings - IEEE INFOCOM

Volumn , Issue , 2011, Pages 2078-2086

  Xu, Kuai ^a   Wang, Feng ^a   Gu, Lin ^b  

^a ARIZONA STATE UNIVERSITY   (United States)

^b HONG KONG UNIVERSITY OF SCIENCE AND TECHNOLOGY   (Hong Kong)

Author keywords

[No Author keywords available]

Indexed keywords

ANOMALOUS BEHAVIOR; BIPARTITE GRAPHS; DENIAL OF SERVICE ATTACKS; INTERNET BACKBONE; MODEL NETWORKS; NETWORK BEHAVIORS; PROJECTION GRAPH; TRAFFIC CHARACTERISTICS; WORM PROPAGATION;

CLUSTERING ALGORITHMS; INFORMATION THEORY; INTERNET; TELECOMMUNICATION NETWORKS;

COMPUTER CRIME;

EID: 79960853919     PISSN: 0743166X     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/INFCOM.2011.5935017     Document Type: Conference Paper

References (30)

1. S. Wei, J. Mirkovic, and E. Kissel, "Profiling and Clustering Internet Hosts," in Proceedings of the International Conference on Data Mining, June 2006.
2. K. Xu, Z.-L. Zhang, and S. Bhattacharyya, "Profiling Internet Backbone Traffic: Behavior Models and Applications," in Proceedings of ACM SIGCOMM, August 2005.
3. H. Jiang, Z. Ge, S. Jin, and J. Wang, "Network Prefix-level Traffic Profiling: Characterizing, Modeling, and Evaluation," Computer Networks, 2010.
4. Y. Jin, E. Sharafuddin, and Z.-L. Zhang, "Unveiling core networkwide communication patterns through application traffic activity graph decomposition," in Proceedings of ACM SIGMETRICS, June 2009.
5. T. Karagiannis, K. Papagiannaki, and M. Faloutsos, "BLINC: Multilevel Traffic Classification in the Dark," in Proceedings of ACM SIGCOMM, August 2005.
6. M. Iliofotou, P. Pappu, M. Faloutsos, M. Mitzenmacher, S. Singh, and G. Varghese, "Network monitoring using traffic dispersion graphs," in Proceedings of ACM SIGCOMM Internet Measurement Conference, 2007.
7. J.-L. Guillaume, and M. Latapy, "Bipartite graphs as models of complex networks," Physica A: Statistical and Theoretical Physics, vol. 371, no. 2, pp. 795 - 813, 2006.
8. Y. Weiss, "Segmentation Using Eigenvectors: A Unifying View," in Proceedings of the International Conference on Computer Vision, 1999.
9. M. Maila and J. Shi, "Learning Segmentation with Random Walk," in Proceedings of Neural Information Processing Systems (NIPS) Conference, 2001.
10. A. Ng, M. Jordan, and Y. Weiss, "On Spectral Clustering: Analysis and an Algorithm," in Proceedings of Neural Information Processing Systems (NIPS) Conference, 2001.
11. Cooperative Association for Internet Data Analysis (CAIDA), "Internet Traces," http://www.caida.org/data/passive/passive-2009- dataset.xml.
12. J. Fan, J. Xu, M. Ammar, and S. Moon, "Prefix-preserving IP address anonymization: measurement-based security evaluation and a new cryptography-based scheme," Computer Networks, vol. 46, no. 2, pp. 253-272, October 2004.
13. University of Oregon, "Route Views Project," http://www.routeviews.org/.
14. T. Cover and J. Thomas, Elements of Information Theory. Wiley Series in Telecommunications, 1991.
15. C. Shannon and D. Moore, "The spread of the witty worm," IEEE Security and Privacy, vol. 2, no. 4, pp. 46 - 50, 2004.
16. A. Hussain, J. Heidemann, and C. Papadopoulos, "A Framework for Classifying Denial of Service Attacks," in Proceedings of ACM SIGCOMM, August 2003.
17. I. Trestian, S. Ranjan, A. Kuzmanovi, and A. Nucci, "Unconstrained endpoint profiling (googling the internet)," in Proceedings of ACM SIGCOMM, August 2008.
18. K. Theriault, D. Vukelich, W. Farrell, D. Kong, and J. Lowry, "Network Traffic Analysis Using Behavior-Based Clustering," BBN Technologies Technical Report, 2010.
19. G. Tan, M. Poletto, J. Guttag, and F. Kaashoek, "Role Classification of Hosts within Enterprise Networks Based on Connection Patterns," in Proceedings of USENIX Annual Technical Conference, June 2003.
20. W. Aiello, C. Kalmanek, P. McDaniel, S. Sen, O. Spatscheck, and J. Merwe, "Analysis of Communities of Interest in Data Networks," in Proceedings of Passive and Active Measurments Workshop, March 2005.
21. A. Soule, K. Salamatia, N. Taft, R. Emilion, and K. Papagiannaki, "Flow classification by histograms: or how to go on safari in the internet," in Proceedings of ACM SIGMETRICS, June 2004.
22. S. Bhattacharyya, C. Diot, J. Jetcheva, and N. Taft, "Pop-level and access-link-level traffic dynamics in a tier-1 POP," in Proceedings of ACM SIGCOMM Workshop on Internet Measurement, San Francisco, CA, 2001.
23. A. Lakhina, M. Crovella, and C. Diot, "Diagnosing Network-Wide Traffic Anomalies," in Proceedings of ACM SIGCOMM, 2004.
24. A. Ramachandran and N. Feamster, "Understanding the Network-Level Behavior of Spammers," in Proceedings of ACM SIGCOMM, September 2006.
25. Z. Qian, Z. Mao, Y. Xie, and F. Yu, "On Network-level Clusters for Spam Detection," in Proceedings of Network and Distributed System Security Symposium (NDSS), March 2010.
26. B. Krishnamurthy, and J. Wang, "On network-aware clustering of Web clients," in Proceedings of ACM SIGCOMM, August 2000.
27. Y. Xie, F. Yu, K. Achan, E. Gillum, M. Goldszmidt, and T. Wobber, "How dynamic are IP addresses?" in Proceedings of ACM SIGCOMM, August 2007.
28. X. Cai, and J. Heidemann, "Understanding Block-level Address Usage in the Visible Internet," in Proceedings of ACM SIGCOMM, August 2010.
29. M. Schwartz, and D. Wood, "Discovering shared interests using graph analysis," Communications of the ACM, vol. 36, no. 8, pp. 78 - 89, August 1993.
30. S. Nagaraja, P. Mittal, C.-Y. Hong, M. Caesar, and N. Borisov, "BotGrep: Finding P2P Bots with Structured Graph Analysis," in Proceedings of USENIX Security Symposium, August 2010.