DANAK: Finding the odd!

Proceedings - 2011 5th International Conference on Network and System Security, NSS 2011

Volumn , Issue , 2011, Pages 161-168

  Wagner, Cynthia ^a   François, Jérôme ^a   State, Radu ^a   Engel, Thomas ^a  

^a UNIVERSITY OF LUXEMBOURG   (Luxembourg)

Author keywords

[No Author keywords available]

Indexed keywords

ANOMALY DETECTION; ATTACK STRATEGIES; KERNEL FUNCTION; MACHINE LEARNING TECHNIQUES; NETFLOWS; NETWORK CONNECTIVITY; NETWORK MONITORING; NETWORK SIZE; PHASE SPACE EMBEDDING; QUANTITATIVE INFORMATION; REAL DATA SETS; TEMPORAL INFORMATION; TRAFFIC CLASSIFICATION;

LEARNING SYSTEMS; PHASE SPACE METHODS; TELECOMMUNICATION TRAFFIC;

NETWORK SECURITY;

EID: 81055155520     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ICNSS.2011.6059996     Document Type: Article

References (29)

1. Arbor Networks, Peakflow SP: Traffic anomaly detection. http://www.arbornetworks.com/en/peakflow-sp-traffic-anomaly-detection-4.html, last accessed: 29 March 2011.
2. P. Bahl, R. Chandra, A. Greenberg and S. Kandula and D. A. Maltz and M. Zhang, Towards highly reliable Enterprise Network Services via Inference of Multi-level Dependencies. ACM SIGCOMM'07, Kyoto, Japan, 2007.
3. L. Breiman, J. H. Friedman, and R. A. Olshen and C. J. Stone, Classification and Regression Trees. Belmont, California, Wadsworth International Group, 1984.
4. D. Braickhoff, A. Wagner and M. May, FLAME: a flow-level anomaly modeling engine. Proceedings of the conference on Cyber Security experimentation and test, USENIX Association, San Jose, CA, 2008.
5. A. Caracas, A. Kind, S. Fussenegger and D. Dechouniotis, Mining semantic relations using NetFlow. 3rd IEEE/IFIP International Workshop on Business-Driven IT Management, pp. 110-111, Salvador, Brazil, 2008.
6. K. Cho, R. Kaizaki and A. Kato, Aguri: An aggregation-based traffic profiler. QoflS2001, Lecture Notes in Computer Science 2156, pp. 222-242, Springer, 2001.
7. Ed. B. Claise, Cisco Systems Netflow Services Export Version 9. http://tools.ietf.org/html/rfc3954, 2004.
8. N. Duffield, P. Haffner and B. Krishnamurthy and H. Ringberg, Rulebased Anomaly Detection on IP Flows. In Proceedings of IEEE INFOCOM, pp. 424-432, Rio de Janeiro, Brazil, 2009.
9. C. Estan, Building a better NetFlow. In Proceedings of the conference on Applications, technologies, architectures, and protocols for computer communications, pp. 245-256, 2004.
10. P. Giura and N. Memon, NetStore: An efficient storage infrastructure for network forensics and monitoring. In 13th Recent Advances in Intrusion Detection (RAID) Conference, Lecture Notes in Computer Science, Springer, 2010.
11. [II] G. Hulten, A. Penta and G. Seshadrinathan and M. Mishra, Trends in Spam Products and Methods. Proceedings of CEAS, http://ceas.cc/2004/165.pdf, 2004.
12. R. Kaizaki, K. Cho and O. Nakamura, Detection of Denial of Service attacks using AGURI. International Conference Telecommunications ICT2002, Beijing, China, 2002.
13. T. Karagiannis, K. Papagiannaki and M. Faloutsos, BLINC: Multilevel Traffic Classification in the Dark. ACM SIGCOMM'05, Philadelphia, Pennsylvania, USA, 2005.
14. L. Kahn, M. Awad and B. Thuraisungham, A new intrusion detection system using support vector machines and hierarchical clustering. The VLDB Journal, vol. 16, iss. 4, pp. 507-521, Springer, 2007.
15. J. B. Kruskal, On the shortest spanning subtree of a graph and the traveling salesman problem. In Proceedings of the American Mathematical Society, vol. 7, pp. 48-50, 1956.
16. A. Lakhina, M. Crovella and C. Diot, Mining Anomalies Using Traffic Feature Distributions. ACM SIGCOMM'05, Philadelphia, Pennsylvania, USA, 2005.
17. W. Lee, S. J. Stolfo and K. W. Mok, Mining in a data-flow environment: experience in network intrusion detection. 5th International Conference on Knowledge Discovery and Data Mining (SIGKDD), pp. 114-124, San Diego, US, 1999.
18. B. B. Mandelbrot, The Fractal Geometry of Nature. W. H. Freeman and Company, NY, 1982.
19. A. McGregor, M. Hall and P. Lorier and J. Brunskill, Flow Clustering using machine learning techniques. Passive and Active Network Measurement, Lecture Notes in Computer Science, Springer, 2004.
20. D. R. Morrison, PATRICIA - Practical Algorithm To Retrieve Infromation Coded in Alphanumeric. ACM Journal, vol 15, iss. 4, pp. 514-534, 1968.
21. I. Paredes-Oliva, Portscan Detection with Sampled NetFlow. Lecture Notes in Computer Science, vol. 5537, pp. 26-33, 2009.
22. Y. Rekhter and T. Li, An Architecture for IP Address Allocation with CIDR. RFC1518, http://tools.ietf.org/html/rfc1518, September 1993.
23. B. Schoelkopf, J. C. Platt and J. C. Shawe-Taylor and A. J. Smola and R. C. Williamson, Estimating the Support of a High-Dimensional Distribution. Neural Computation, vol. 13, pp..1443-1471, MIT Press, 2001.
24. F. Takens, Detecting Strange Attractors in Turbulence. Itn Dynamical Systems and Turbulence, Lecture Notes in Mathematics, vol. 898, Berlin, pp. 366-381, 1981.
25. V. Vapnik, Statistical Learning Theory. Wiley-Inderscience, 10-9780471030034, 1998.
26. C. Wagner, J. François and R. State and T. Engel, Machine Learning Approach for IP-Flow Record Anomaly Detection. In IFIP Networking 2011, Lecture Notes in Computer Science, vol. 6640, Springer, 2011.
27. C. Wagner, G. Wagener and R. State and A. Dulaunoy and T. Engel, Game Theory driven monitoring of spatial-aggregated IP-Flow records. 6th International Conference on Network and services Management, Niagara Falls, Ontario, Canada, 2010.
28. M. Zalewski, Strange Attractors and TCP/IP Sequence Number Analysis. http://www.lcamtuf.coredump. cx/tcpseq.html, 2001, last accessed: January 2011.
29. H. Zang, Traffic monitor deployment in IP networks. In Computer Networks: The International Journal of Computer and Telecommunications Networking, vol. 53, Issue 14, pp. 2491-2501, 2009.