Practical anomaly detection based on classifying frequent traffic patterns

Proceedings - IEEE INFOCOM

Volumn , Issue , 2012, Pages 49-54

  Paredes Oliva, Ignasi ^a   Castell Uroz, Ismael ^a   Barlet Ros, Pere ^a   Dimitropoulos, Xenofontas ^b   Solé Pareta, Josep ^a  

^a UNIVERSITAT POLITÈCNICA DE CATALUNYA   (Spain)

^b ETH ZURICH   (Switzerland)

Author keywords

Anomaly Classification; Anomaly Detection; NetFlow; Network Security

Indexed keywords

10 GB/ S; ANOMALY DETECTION; AUTOMATIC CLASSIFICATION; BACK-BONE NETWORK; CATALANS; CLASSIFICATION ACCURACY; CLASSIFICATION SYSTEM; DECISION TREE LEARNING; KEY FEATURE; NETFLOWS; NETWORK ANOMALIES; NETWORK OPERATOR; NETWORK TRAFFIC; NETWORKED SERVICES; OPERATIONAL PLATFORMS; REAL NETWORKS; RESEARCH AND EDUCATION NETWORK; SECURITY INCIDENT; TRAFFIC PATTERN; TRAFFIC TRACES;

DECISION TREES;

NETWORK SECURITY;

EID: 84862104139     PISSN: 0743166X     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/INFCOMW.2012.6193518     Document Type: Conference Paper

References (24)

1. K.-K. R. Choo, "The cyber threat landscape: Challenges and future research directions," Computers & Security, Vol. 30, no. 8, pp. 719-731, 2011.
2. P. Barford, J. Kline, D. Plonka, and A. Ron, "A signal analysis of network traffic anomalies," in Proceedings of ACM SIGCOMM Workshop on Internet Measurment, 2002.
3. A. Lakhina, M. Crovella, and C. Diot, "Diagnosing network-wide traffic anomalies," in Proceedings of ACM SIGCOMM, 2004.
4. "Characterization of network-wide anomalies in traffic flows," in Proceedings of ACM SIGCOMM conference on Internet Measurement (IMC), 2004.
5. A. Soule, K. Salamatian, and N. Taft, "Combining filtering and statistical methods for anomaly detection," in Proceedings of ACM SIGCOMM conference on Internet Measurement (IMC), 2005.
6. M. Molina, W. Routly, I. Paredes-Oliva, and A. Jain, "Anomaly Detection in Backbone Networks: Building a Security Service Upon an Innovative Tool." in Proceedings of Terena Networking Conference (TNC), 2010.
7. D. Brauckhoff, X. Dimitropoulos, A. Wagner, and K. Salamatian, "Anomaly extraction in backbone networks using association rules," in Proceedings of ACM SIGCOMM conference on Internet Measurement (IMC), 2009.
8. V. Chandola, A. Banerjee, and V. Kumar, "Anomaly detection: A survey," ACM Computing Surveys, Vol. 41, no. 3, pp. 1-58, 2009.
9. F. Silveira and C. Diot, "URCA: Pulling out anomalies by their root causes," in Proceedings of IEEE INFOCOM, 2010.
10. G. Grahne and J. Zhu, "Efficiently using prefix-trees in mining frequent itemsets," in Proceedings of Workshop on Frequent Itemset Mining Implementations (FIMI), 2003.
11. A. Lakhina, M. Crovella, and C. Diot, "Mining anomalies using traffic feature distributions," in Proceedings of ACM SIGCOMM, 2005.
12. B. Tellenbach, M. Burkhart, D. Schatzmann, D. Gugelmann, and D. Sornette, "Accurate network anomaly classification with generalized entropy metrics," Computer Networks, Vol. 55, no. 15, pp. 3485-3502, Oct. 2011.
13. H. Choi, H. Lee, and H. Kim, "Fast detection and visualization of network attacks on parallel coordinates," Computers & Security, Vol. 28, no. 5, pp. 276-288, 2009.
14. X. Li, F. Bian, M. Crovella, C. Diot, R. Govindan, G. Iannaccone, and A. Lakhina, "Detection and identification of network anomalies using sketch subspaces," in Proceedings of ACM SIGCOMM conference on Internet Measurement (IMC), 2006.
15. R. Agrawal, T. Imieliski, and A. Swami, "Mining association rules between sets of items in large databases," ACM SIGMOD Record, Vol. Vol. 22, pp. 207-216, 1993.
16. B. Goethals and M. Zaki, "FIMI03: Workshop on frequent itemset mining implementations," in Proceedings of Workshop on Frequent Itemset Mining Implementations (FIMI), 2003.
17. P. E. Proctor, "Marketscope for network behavior analysis," Gartner Research Report G00144385, 2006.
18. H. Kim, K. Claffy, M. Fomenkov, D. Barman, M. Faloutsos, and K. Lee, "Internet traffic classification demystified: Myths, caveats, and the best practices," in Proceedings of ACM CoNEXT, 2008.
19. J. Quinlan, C4. 5: Programs for Machine Learning. Morgan Kaufmann, 1993.
20. Guavus, "NetReflex," http://www.guavus.com.
21. Arbor Networks, "PeakFlow SP," http://www.arbornetworks.com/.
22. Lancope, "StealthWatch," http://www.lancope.com/.
23. I. Paredes-Oliva, X. Dimitropoulos, M. Molina, P. Barlet-Ros, and D. Brauckhoff, "Automating root-cause analysis of network anomalies using frequent itemset mining (demo)," in Proceedings of ACM SIG-COMM, 2010.
24. P. Barlet-Ros, J. Solé-Pareta, J. Barrantes, E. Codina, and J. Domingo-Pascual, "SMARTxAC: A passive monitoring and analysis system for high-speed networks." Campus-Wide Information Systems, Vol. 23, no. 4, pp. 283-296, 2006.