Traffic anomaly detection based on the IP size distribution

Proceedings - IEEE INFOCOM

Volumn , Issue , 2012, Pages 2005-2013

  Soldo, Fabio ^a   Metwally, Ahmed ^a  

^a GOOGLE INC   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

DATA SETS; ENSEMBLE LEARNING; FUNDAMENTAL CHARACTERISTICS; LOW COMPLEXITY; NETWORK TRAFFIC; TRAFFIC ANOMALIES;

DATA PROCESSING; STATISTICAL TESTS;

SIZE DISTRIBUTION;

EID: 84861584915     PISSN: 0743166X     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/INFCOM.2012.6195581     Document Type: Conference Paper

References (23)

1. Interactive Advertising Bureau, Annual Report, http://www.iab.net/media/ file/IAB-Ad-Revenue-Full-Year-2009.pdf.
2. The Kelsey Group, Annual Forecast, http://www.kelseygroup.com/press/ pr080225.asp.
3. N. Kshetri, "The economics of click fraud," IEEE Security and Privacy, 2010.
4. C. Mann, "How click fraud could swallow the Internet," Wired Magazine, 2006.
5. B. Grow, B. Elgin, and M. Herbst, "Click Fraud-The dark side of online advertising," BusinessWeek online, vol. 10, no. 02, 2006.
6. A. Metwally and M. Paduano, "Estimating the Number of Users behind IP Addresses for Combating Abusive Traffic," ACM SIGKDD 17th International Conference on Knowledge Discovery and Data Mining, 2011.
7. B. Taylor, "Sender reputation in a large webmail service," in Third Conference on Email and Anti-Spam (CEAS), 2006.
8. Spamhaus XBL, http://www.spamhaus.org/xbl/.
9. R. Pike, S. Dorward, R. Griesemer, and S. Quinlan, "Interpreting the data: Parallel analysis with Sawzall," Scientific Programming, vol. 13, no. 4, pp. 277-298, 2005.
10. J. Dean and S. Ghemawat, "MapReduce: Simplified data processing on large clusters," Communications of the ACM, vol. 51, no. 1, pp. 107-113, 2008.
11. P. Sollich and A. Krogh, "Learning with ensembles: How overfitting can be useful," Advances in neural information processing systems, pp. 190-196, 1996.
12. K. Najim, E. Ikonen, and A. Daoud, Stochastic processes: estimation, optimization, & analysis. Butterworth-Heinemann, 2004.
13. J. Lin, "Divergence measures based on the shannon entropy," IEEE Transactions on Information Theory, vol. 37, no. 1, pp. 145-151, 1991.
14. K. Kira and L. Rendell, "The feature selection problem: Traditional methods and a new algorithm," in Proceedings of the National Conference on Artificial Intelligence. JohnWiley&SonsLtd,1992,pp. 129-129.
15. J. Goodman, "Pay-per-percentage of impressions: an advertising method that is highly robust to fraud," in Workshop on Sponsored Search Auctions, 2005.
16. A. Juels, S. Stamm, and M. Jakobsson, "Combating click fraud via premium clicks," in Proceedings of 16th USENIX Security Symposium. USENIX Association, 2007, pp. 1-10.
17. A. Metwally, D. Agrawal, and A. El Abbadi, "Detectives: detecting coalition hit inflation attacks in advertising networks streams," in Proceedings of the 16th international conference on World Wide Web. ACM, 2007, pp. 241-250.
18. A. Metwally, F. Emekçi, D. Agrawal, and A. El Abbadi, "SLEUTH: Single-pubLisher attack detection Using correlation Hunting," Proceedings of the VLDB Endowment, vol. 1, no. 2, pp. 1217-1228, 2008.
19. N. Daswani and M. Stoppelman, "The anatomy of Clickbot. A," in Proceedings of the first conference on First Workshop on Hot Topics in Understanding Botnets. USENIX Association, 2007,p.11.
20. V. Chandola, A. Banerjee, and V. Kumar, "Anomaly detection: A survey," ACM Computing Surveys (CSUR), vol. 41, no. 3, pp. 1-58, 2009.
21. R. Becker, C. Volinsky, and A. Wilks, "Fraud Detection in Telecommunications: History and Lessons Learned," Technometrics, vol. 52, no. 1, pp. 20-33, 2010.
22. A. Kind, M. Stoecklin, and X. Dimitropoulos, "Histogram-based traffic anomaly detection," IEEE Transactions on Network and Service Management, vol. 6, no. 2, pp. 110-121, 2010.
23. Y. Xie, F. Yu, K. Achan, E. Gillum, M. Goldszmidt, and T. Wobber, "How dynamic are IP addresses?" ACM SIGCOMM Computer Communication Review, vol. 37, no. 4, pp. 301-312, 2007.