Accurate network anomaly classification with generalized entropy metrics

Computer Networks

Volumn 55, Issue 15, 2011, Pages 3485-3502

  Tellenbach, Bernhard ^a   Burkhart, Martin ^a   Schatzmann, Dominik ^a   Gugelmann, David ^a   Sornette, Didier ^a  

^a ETH ZURICH   (Switzerland)

Author keywords

Anomaly classification; Anomaly detection; Generalized entropy; Netflow; Traffic entropy spectrum (TES); Tsallis

Indexed keywords

ANOMALY CLASSIFICATION; ANOMALY DETECTION; GENERALIZED ENTROPY; NETFLOWS; TSALLIS;

CLASSIFICATION (OF INFORMATION); OPTICAL TELESCOPES; PRINCIPAL COMPONENT ANALYSIS; REFINING; TELESCOPES;

ENTROPY;

EID: 80052448813     PISSN: 13891286     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.comnet.2011.07.008     Document Type: Article

References (39)

1. A. Lakhina, M. Crovella, C. Diot, Diagnosing network-wide traffic anomalies, in: ACM SIGCOMM, 2004.
2. A. Lakhina, M. Crovella, C. Diot, Mining anomalies using traffic feature distributions, in: ACM SIGCOMM, 2005.
3. D. Brauckhoff, K. Salamatian, M. May, Applying PCA for Traffic Anomaly Detection: Problems and Solutions, in: INFOCOM, 2009.
4. X. Li, F. Bian, M. Crovella, C. Diot, R. Govindan, G. Iannaccone, A. Lakhina, Detection and identification of network anomalies using sketch subspaces, in: Internet Measurement Conference (IMC), 2006.
5. A. Ziviani, M.L. Monsores, P.S.S. Rodrigues, and A.T.A. Gomes Network anomaly detection using nonextensive entropy IEEE Communications Letters 11 12 2007 1034 1036
6. B. Tellenbach, M. Burkhart, D. Sornette, T. Maillart, Beyond Shannon: Characterizing Internet Traffic with Generalized Entropy Metrics, in: Passive and Active Measurement Conference (PAM), 2009.
7. A. Soule, K. Salamatian, N. Taft, Combining filtering and statistical methods for anomaly detection, in: Internet Measurement Conference (IMC), 2005.
8. G. Nychis, V. Sekar, D.G. Andersen, H. Kim, H. Zhang, An empirical evaluation of entropy-based traffic anomaly detection, in: Internet Measurement Conference (IMC), 2008.
9. H. Ringberg, M. Roughan, and J. Rexford The need for simulation in evaluating anomaly detectors SIGCOMM Comput. Commun. Rev. 38 1 2008 55 59
10. D. Brauckhoff, A. Wagner, M. May, FLAME: a flow-level anomaly modeling engine, in: Workshop on Cyber Security Experimentation and Test (CSET), 2008.
11. B. Tellenbach, Collection of FLAME anomaly models, http://people.ee.ethz. ch/betellen/AnomalyModels, visited on July 29, 2010.
12. SWITCH, The Swiss education and research network, http://www.switch.ch, visited on July 29, 2010.
13. A. Wagner, B. Plattner, Entropy based worm and anomaly detection in fast IP networks, in: IEEE WET ICE, 2005.
14. H. Frank, and S. Althoen Statistics: Concepts and Applications 1994 Cambridge University Press
15. T. Dübendorfer, A. Wagner, T. Hossmann, B. Plattner, Flow-level traffic analysis of the blaster and sobig worm outbreaks in an internet backbone, in: SIG SIDAR DIMVA, 2005.
16. C. Shannon, and D. Moore The spread of the witty worm IEEE Security and Privacy 2 4 2004 46 50 doi: http://dx.doi.org/10.1109/MSP.2004.59
17. A. Dainotti, A. Pescap, G. Ventre, Worm traffic analysis and characterization, in: IEEE ICC, 2007.
18. P. Barford, J. Kline, D. Plonka, A. Ron, A signal analysis of network traffic anomalies, in: Internet Measurement Workshop (IMW), 2002.
19. C.-C. Chang, C.-J. Lin, LIBSVM: a library for support vector machines, software available at http://www.csie.ntu.edu.tw/cjlin/libsvm. Visited on July 29, 2010.
20. C.-W. Hsu, C.-C. Chang, C.-J. Lin, A practical guide to support vector classification, Tech. rep., Department of Computer Science, National Taiwan University, 2009.
21. R. Fisher The use of multiple measurements in taxonomic problems Annals of Eugenics 7 1936 179 188
22. M. Allman, V. Paxson, J. Terrell, A brief history of scanning, in: Internet Measurement Conference (IMC), 2007.
23. D. Moore, C. Shannon, D.J. Brown, G.M. Voelker, and S. Savage Inferring internet denial-of-service activity ACM Transactions on Computational System 24 2 2006 115 139
24. VeriSign, Distributed Denial of Service (DDoS) Attacks: Latest Motivations and Methods, http://www.verisign.com/static/idefense-ddos-verisign- 20080908.pdf, visited on July 29, 2010.
25. R. Richardson, CSI computer crime and security survey 2008, Computer Security Institute.
26. M. Stoecklin, Anomaly detection by finding feature distribution outliers, in: ACM CoNEXT, 2006.
27. M.P. Stoecklin, J.-Y. LeBoudec, A. Kind, A two-layered anomaly detection technique based on multi-modal flow behavior models, in: Passive and Active Measurement Conference (PAM), 2008.
28. B. Krishnamurthy, S. Sen, Y. Zhang, Y. Chen, Sketch-based change detection: methods, evaluation, and applications, in: Internet Measurement Conference (IMC), 2003.
29. X. Dimitropoulos, M. Stoecklin, P. Hurley, and A. Kind The eternal sunshine of the sketch data structure Computer Networks 52 17 2008 3248 3257
30. G. Dewaele, K. Fukuda, P. Borgnat, P. Abry, K. Cho, Extracting hidden anomalies using sketch and non gaussian multiresolution statistical detection procedures, in: Workshop on Large Scale AttackDefense (LSAD), 2007.
31. M. Alencar, F. Assis, A relation between the renyi distance of order and the variational distance, in: Telecommunications Symposium, 1998, pp. 242-244 vol.1. doi:10.1109/ITS.1998.713125.
32. X. Song, M. Wu, C. Jermaine, S. Ranka, Statistical change detection for multi-dimensional data, in: ACM SIGKDD Conference on Knowledge Discovery and Data mining (KDD).
33. Y. Gu, A. McCallum, D. Towsley, Detecting anomalies in network traffic using maximum entropy estimation, in: Internet Measurement Conference (IMC), 2005.
34. M.Z. Shafiq, S.A. Khayam, M. Farooq, Improving accuracy of immune-inspired malware detectors by using intelligent features, in: Conference on Genetic and Evolutionary Computation (GECCO), 2008.
35. W. Guo, S. Cui, Fast convergence with q-expectation in em-based blind iterative detection, in: Asilomar Conference on Signals, Systems and Computers (ACSSC), 2006.
36. M.E. Torres, M.M. An++ino, and G. Schlotthauer Automatic detection of slight parameter changes associated to complex biomedical signals using multiresolution q-entropy Medical Engineering & Physics 25 10 2003 859 867 (Pubitemid 37421348)
37. J. Gao, W.W. Tung, Y. Cao, J. Hu, and Y. Qi Power-law sensitivity to initial conditions in a time series with applications to epileptic seizure detection Physica A: Statistical Mechanics and its Applications 353 2005 613 624 (Pubitemid 40684326)
38. Nonextensive statistical mechanics and thermodynamics: Bibliography, http://tsallis.cat.cbpf.br/biblio.htm, visited on July 29, 2010.
39. M. Burkhart, D. Brauckhoff, M. May, E. Boschi, The risk-utility tradeoff for IP address truncation, in: ACM workshop on Network Data Anonymization (NDA), 2008.