Detecting Heavy Change in the Heavy Hitter distribution of network traffic

IWCMC 2011 - 7th International Wireless Communications and Mobile Computing Conference

Volumn , Issue , 2011, Pages 1298-1303

  Callegari, Christian ^a   Giordano, Stefano ^a   Pagano, Michele ^a   Pepe, Teresa ^a  

^a UNIVERSITY OF PISA   (Italy)

Author keywords

Anomaly Detection; Heavy Change; Heavy Hitter; Sketch

Indexed keywords

ANOMALY DETECTION; EXPERIMENTAL EVALUATION; HEAVY CHANGE; HEAVY-HITTER; IP NETWORKS; NETWORK ANOMALY DETECTION; NETWORK ATTACK; NETWORK OPERATOR; NETWORK TRAFFIC; NOVEL METHODS; PERFORMANCE ANALYSIS; SKETCH;

COMPUTER CRIME; COMPUTER NETWORKS; MOBILE COMPUTING; WIRELESS TELECOMMUNICATION SYSTEMS;

NETWORK MANAGEMENT;

EID: 80052448261     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/IWCMC.2011.5982727     Document Type: Conference Paper

References (23)

1. C. Callegari, L. Gazzarrini, S. Giordano, M. Pagano, and T. Pepe, "When randomness improves the anomaly detection performance," in Proceedings of 3rd International Symposium on Applied Sciences in Biomedical and Communication Technologies (ISABEL), 2010.
2. M. Charikar, K. Chen, and M. Farach-colton, "Finding frequent items in data streams," in Proc. VLDB Endow., pp. 693-703, 2002.
3. R. M. Karp, C. H. Papadimitriou, and S. Shenker, "A simple algorithm for finding frequent elements in streams and bags," ACM Transactions on Database Systems, vol. 28, p. 2003, 2003.
4. G. S. Manku and R. Motwani, "Approximate frequency counts over data streams," in VLDB, pp. 346-357, 2002.
5. G. Cormode and S. Muthukrishnan, "What's hot and what's not: Tracking most frequent items dynamically," in In Proceedings of ACM Principles of Database Systems, pp. 296-306, 2003.
6. C. Estan and G. Varghese, "New directions in traffic measurement and accounting: Focusing on the elephants, ignoring the mice," ACM Transactions on Computer Systems, vol. 21, pp. 270-313, 2003.
7. G. S. Manku and R. Motwani, "Approximate frequency counts over data streams," in VLDB, pp. 346-357, 2002.
8. G. Cormode, S. Muthukrishnan, and D. Srivastava, "Finding hierarchical heavy hitters in data streams," in In Proc. of VLDB, pp. 464-475, 2003.
9. P. Cheung-Mon-Chan and F. Clerot, "Finding hierarchical heavy hitters with the count min sketch," in Proceedings of 4th International Workshop on Internet Performance, Simulation, Monitoring and Measurement, IPS-MOME, 2006.
10. K. L. Fox, R. R. Henning, J. H. Reed, and R. P. Simonian, "A neural network approach towards intrusion detection," in In Proc. 13th National Computer Security Conference. Information Systems Security. Standards - the Key to the Future, Vol. I, pp. 124-134, 1990.
11. N. Ye, "A markov chain model of temporal behavior for anomaly detection," in Proceedings of the Workshop on Information Assurance and Security, 2000.
12. J. Tolle and O. Niggemann, "Supporting intrusion detection by graph clustering and graph drawing," in In, Springer, 2000.
13. B. K. Subhabrata, E. Krishnamurthy, S. Sen, Y. Zhang, and Y. Chen, "Sketch-based change detection: Methods, evaluation, and applications," in In Internet Measurement Conference, pp. 234-247, 2003.
14. G. Cormode and S. Muthukrishnan, "What's new: Finding significant differences in network data streams," in in Proc. of IEEE Infocom, pp. 1534-1545, 2004.
15. S. Muthukrishnan, "Data streams: algorithms and applications," in Proceedings of the fourteenth annual ACM-SIAM symposium on Discrete algorithms, (Philadelphia, PA, USA), pp. 413-413, Society for Industrial and Applied Mathematics, 2003.
16. G. Cormode and S. Muthukrishnan, "An improved data stream summary: the count-min sketch and its applications," Journal of Algorithms, vol. 55, no. 1, pp. 58 - 75, 2005.
17. M. Thorup and Y. Zhang, "Tabulation based 4-universal hashing with applications to second moment estimation," in SODA '04: Proceedings of the fifteenth annual ACM-SIAM symposium on Discrete algorithms, (Philadelphia, PA, USA), pp. 615-624, Society for Industrial and Applied Mathematics, 2004.
18. B. Claise, "Cisco Systems NetFlow Services Export Version 9." RFC 3954 (Informational), Oct. 2004.
19. "Flow-Tools Home Page." http://www.ietf.org/rfc/rfc3954.txt.
20. R. Lippmann, J. Haines, D. Fried, J. Korba, and K. Das, "The 1999 DARPA off-line intrusion detection evaluation," Computer Networks, vol. 34, no. 4, pp. 579-595, 2000.
21. M. V. Mahoney and P. K. Chan, "An analysis of the 1999 darpa/lincoln laboratory evaluation data for network anomaly detection," in In Proceedings of the Sixth International Symposium on Recent Advances in Intrusion Detection, pp. 220-237, Springer-Verlag, 2003.
22. A. Lakhina, M. Crovella, and C. Diot, "Mining anomalies using traffic feature distributions," SIGCOMM Comput. Commun. Rev., vol. 35, no. 4, pp. 217-228, 2005.
23. "The Internet2 Network." http://www.internet2.edu/network/.