Monitoring abnormal network traffic based on blind source separation approach

Journal of Network and Computer Applications

Volumn 34, Issue 5, 2011, Pages 1732-1742

  Qin, Tao ^a   Guan, Xiaohong ^a,b   Li, Wei ^a   Wang, Pinghui ^a   Huang, Qiuzhen ^a  

^a XI'AN JIAOTONG UNIVERSITY   (China)

^b TSINGHUA NATIONAL LABORATORY FOR INFORMATION SCIENCE AND TECHNOLOGY   (China)

Author keywords

Abnormal behavior detection; Blind source separation; DFlow model; Network traffic monitoring; Scale space filter

Indexed keywords

ABNORMAL BEHAVIOR; ABNORMAL PATTERNS; BEHAVIOR PATTERNS; CONNECTION DEGREE; DATA TRACES; DFLOW MODEL; HIGH QUALITY; NETWORK BEHAVIORS; NETWORK DATA; NETWORK TRAFFIC; NETWORK TRAFFIC FLOW; NETWORK TRAFFIC MONITORING; SALIENT FEATURES; SCALE SPACES; SOURCE SEPARATION; TRAFFIC ENVIRONMENT; TRAFFIC FEATURES; TRAFFIC FLOW; TRAFFIC MONITORING; TRAFFIC PATTERN; TRAFFIC VOLUMES;

RANDOM PROCESSES; TRAFFIC CONTROL;

BLIND SOURCE SEPARATION;

EID: 79960922346     PISSN: 10848045     EISSN: 10958592     Source Type: Journal    
DOI: 10.1016/j.jnca.2011.06.006     Document Type: Article

References (48)

1. Aiello W, Kalmanek C, McDaniel P, Sen S, Spatscheck O, Merwe J. Analysis of communities of interest in data networks. In: Proceedings of the passive and active network measurement, Boston, USA, 2005. p. 8396.
2. Barford P, Kline J, Plonka D, Ron A. A signal analysis of network traffic anomalies. In: Proceedings of the ACM SIGCOMM internet measurement workshop, Marseilles, France, 2002. p. 7182.
3. Brauckhoff D, Tellenbach B, Wagner A, Lakhina A, May M. Impact of traffic sampling on anomaly detection metrics. In: Proceedings of internet measurement conference, Janeriro, Brazil, 2006. p. 15964.
4. A.K. Barros, R. Vigario, V. Jousmaki, and N. Ohnishi Extraction of event-related signals from multi-channel bioelectrical measurements IEEE Transactions on Biomedical Engineering 47 5 2000 583 588 (Pubitemid 30316976)
5. CISCO NetFlow: 〈http://www.cisco.com/en/US/products/ps6601/products- white-paper09186a00800a3db9.shtml〉.
6. Cormode G, Muthukrishnan S. An improved data stream summary: the count-min sketch and its applications. In: Proceedings of Latin American theoretical informatics, Buenos Aires, Argentina, 2004. p. 2938.
7. Chandalia G, Rish I. Blind source separation approach to performance diagnosis and dependency discovery. In: Proceedings of the 7th ACM SIGCOMM internet measurement conference, California, USA, 2007. p. 25964.
8. Duffield N, Lund C, Thorup M. Estimating flow distributions from sampled flow statistics. In: Proceedings of the ACM SIGCOMM, Karlsruhe, Germany, 2003. p. 32536.
9. Duffield N, Lund C, Thorup M. Properties and prediction of flow statistics from sampled packet streams. In: Proceedings of the ACM SIGCOMM internet measurement workshop, Marseilles, France, 2002. p. 15971.
10. Duffield N, Lund C, Thorup M. Flow sampling under hard resource constraints. In: Proceedings of the ACM SIGMETRICS, New York, USA, 2004. p. 8596.
11. DAPRA dataset, 〈http://www.ll.mit.edu/mission/communications/ist/ corpora/ideval/docs/detections-1999.html〉
12. P. Flajolet, and G. Martin Probabilistic counting algorithms for data base applications, Journal of Computer and System Sciences 31 2 1985 182 209
13. J.H. Friedman, and J.W. Tukey A projection pursuit algorithm for exploratory data analysis IEEE Transactions on Computers 23 9 1974 881 890
14. G. Giorgi, and C. Narduzzi Detection of anomalous behaviors in networks from traffic measurements IEEE Transactions on Instrumentation and Measurement 57 12 2008 2782 2791
15. A. Hyvarinen, and E. Oja Independent component analysis: algorithms and applications, Neural Networks 13 2000 411 430 (Pubitemid 30447427)
16. A. Hyvärinen New approximations of differential entropy for independent component analysis and projection pursuit Advances in Neural Information Processing Systems 10 1998 273 279
17. A. Hyvärinen. Fast and robust fixed-point algorithms for independent component analysis IEEE Transactions on Neural Networks 10 3 1999 626 634
18. John W, Tafvelin S. Analysis of internet backbone traffic and header anomalies observed. In: Proceedings of the 7th ACM SIGCOMM conference on internet measurement, San Diego, USA, 2007. p. 1116.
19. Jung J, Paxson V, Berger A, Balakrishnan H. Fast port scan detection using sequential hypothesis testing. In: Proceedings of the IEEE symposium on security and privacy, California, USA, 2004. p. 21125.
20. Kim S, Reddy A. A study of analyzing network traffic as images in real-time. In: Proceedings of the IEEE INFOCOM, Miami, USA, 2005. p. 205667.
21. E. Kohler, J. Li, V. Paxson, and S. Shenker Observed structure of addresses in IP traffic IEEE/ACM Transactions on Networking 14 6 2006 1207 1218 (Pubitemid 46432427)
22. Krishnamurthy B, Sen S, Zhang Y, Chen Y. Sketch-based change detection: methods, evaluation, and applications. In: Proceedings of the ACM SIGCOMM internet measurement conference, Miami, USA, 2003. p. 23447.
23. Keys K, Moore D, Koga.R, Lagache E, Tesch M, Claffy K. The architecture of the Coralreef: internet traffic monitoring software suite. In: Proceedings of the 2nd passive and active measurement workshop, Amsterdam, Netherlands, 2001.
24. KDD Cup 1999 Dataset, 〈http://kdd.ics.uci.edu/databases/kddcup99/ kddcup99.html〉
25. Lee W, Xiang D. Information-theoretic measures for anomaly detection. In: Proceedings of the IEEE symposium on security and privacy, Oakland, USA, 2001. p. 13043.
26. Liu Y, Towsley D, Ye T, Bolot J. An information-theoretic approach to network monitoring and measurement. In: Proceedings of the 5th ACM SIGCOMM internet measurement conference, Berkeley, USA, 2005. p. 114.
27. D. Lee, and N. Brownlee Passive measurement of one-way and two-way flow lifetimes ACM SIGCOMM Computer Communication Review 37 3 2007 17 28
28. Liu H, Feng W, Huang Y, Li X. A peer-to-peer traffic identification method using machine learning. In: Proceedings of the networking, architecture, and storage, Guilin, China, 2007. p. 15560.
29. Lakhina A, Crovella M, Diot C. Characterization of network-wide anomalies in traffic flows. In: Proceedings of the 4th ACM SIGCOMM internet measurement conference, Taormina, Italy, 2004a. p. 2016.
30. A. Lakhina, K. Papagiannaki, M. Crovella, C. Diot, E. Kolaczyk, and N. Taft Structural analysis of network traffic flows ACM SIGMETRICS 32 1 2004 61 72
31. Mahoney MV. Network traffic anomaly detection based on packet bytes. In: Proceedings of the ACM-SAC 2003, Melbourne, USA, 2003. p. 34650.
32. McDaniel P, Sen S, Spatscheck O, Kaashoek F. Enterprise security: a community of interest based approach. In: Proceedings of the 3th annual network and distributed system security symposium, California, USA, 2006. p. 115.
33. Mai J, Chuah C, Sridharan A, Ye T, Zang H. Is sampled data sufficient for anomaly detection. In: Proceedings of the ACM SIGCOMM internet measurement conference, Janeriro, Brazil, 2006. p. 16576.
34. Nychis G, Sekar V, Andersen D, Kim H, Zhang H. An empirical evaluation of entropy-based traffic anomaly detection. In: Proceedings of the 8th ACM SIGCOMM internet measurement conference, Vouliagmeni, Greece, 2008. p. 1516.
35. V. Paxson End-to-end internet packet dynamics IEEE/ACM Transaction on Networking 7 3 1999 277 292
36. Qin X, Dagon D, Gu G, Lee W, Warfield M, Allor P. Worm detection using local networks. In: Proceedings of the recent advances of intrusion detection, Riviera, France, 2004. p. 118.
37. Qin T, Guna X, Li W, Wang P. Monitoring abnormal traffic flows based on independent component analysis. In: Proceedings of the international conference on communications, Dresden, Germany, 2009. p. 15.
38. H. Ringberg, A. Soule, J. Rexford, and C. Diot Sensitivity of PCA for traffic anomaly detection, ACM SIGMETRICS Performance Evaluation Review 35 1 2007 109 120 (Pubitemid 350158077)
39. Staniford S, Moore D, Paxson V, Weaver N. How to own the internet in your spare time. In: Proceedings of the 11th USENIX security symposium, San Francisco, USA, 2002. p. 14967.
40. Sarvotham S, Riedi R, Baraniuk R. Connection-level analysis and modeling of network traffic. In: Proceedings of the ACM SIGCOMM internet measurement workshop, San Francisco, USA, 2001. p. 99103.
41. R. Schweller, Z. Li, Y. Chen, Y. Gao, A. Gupta, Y. Zhang, P. Dinda, M. Kao, and G. Memik Reversible sketches: enabling monitoring and analysis over high-speed data streams, IEEE/ACM Transactions on Networking 15 5 2007 1059 1072 (Pubitemid 350111552)
42. Tan G, Poletto M, Kaashoek F, Guttag J. Role classification of hosts within enterprise networks based on connection patterns. In: Proceedings of the 2003 USENIX annual technical conference, Washington, USA, 2003. p. 1528.
43. M. Thottan, and C. Ji Anomaly detection in IP networks, IEEE Transactions on Signal Processing 51 8 2003 2191 2204
44. Witkin A. Scale space filtering: a new approach to multi-scale description. In: Proceedings of the IEEE international conference on acoustics, speech, signal processing, San Diego, CA, 1984. p. 1503.
45. N. Ye, S. Vilbert, and Q. Chen Computer intrusion detection through EWMA for autocorrelated and uncorrelated data IEEE Transactions on Reliability 52 1 2003 75 82
46. C. Zou, W. Gong, D. Towsley, and L. Gao The monitoring and early detection of internet worms IEEE/ACM Transactions on Networking 13 5 2005 961 974 (Pubitemid 41685008)
47. D. Zuev, and A. Moore Traffic classification using a statistical approach Lecture Notes in Computer Science 3431 2005 321 324 (Pubitemid 41252756)
48. Zhang Y, Ge Z, Greenberg A, Roughan M. Network anomography. In: Proceedings of the 5th ACM SIGCOMM conference on Internet measurement, Berkeley, CA, USA, 2005. p. 31730.