Statistical and signal-based network traffic recognition for anomaly detection

Expert Systems

Volumn 29, Issue 3, 2012, Pages 232-245

  Choraś, Michał ^a,b   Saganowski, Łukasz ^a,b   Renk, Rafał ^a,c   Hołubowicz, Witold ^a,c  

^a ITTI SP Z O O   (Poland)

^b UNIVERSITY OF TECHNOLOGY AND LIFE SCIENCES   (Poland)

^c ADAM MICKIEWICZ UNIVERSITY   (Poland)

Author keywords

anomaly detection; matching pursuit; network security; signal processing

Indexed keywords

ANOMALY DETECTION; FALSE POSITIVE; MATCHING PURSUIT; MATCHING PURSUIT ALGORITHMS; NETWORK TRAFFIC;

ALGORITHMS; DISCRETE WAVELET TRANSFORMS; INTRUSION DETECTION; NETWORK SECURITY; SIGNAL PROCESSING;

SIGNAL DETECTION;

EID: 84863721194     PISSN: 02664720     EISSN: 14680394     Source Type: Journal    
DOI: 10.1111/j.1468-0394.2010.00576.x     Document Type: Article

References (25)

1. Barford, P., J. Kline, D. Plonka, and, A. Ron, (2002) A signal analysis of network traffic anomalies, ACM SIGCOMM InternetMeasurement Workshop 2002, 6-8 November, Marseille, France.
2. Cheng, C.M., H.T. Kung, and, K.S. Tan, (2002) Use of spectral analysis in defense against DoS attacks, IEEE GLOBECOM, 17-21 November, Taipei, Taiwan, R.O.C., pp. 2143-2148.
3. Coppolino, L., L. D'Antonio, M. Esposito, and, L. Romano, (2009) Exploiting diversity and correlation to improve the performance of intrusion detection systems, in Proceedings of IFIP/IEEE International Conference on Network and Service, 24-26 June, Paris, France.
4. Dainotti, A., A. Pescape, and, G. Ventre, (2006) Wavelet-based detection of DoS attacks, IEEE GLOBECOM, 27 November-1 December, San Francisco, CA, USA.
5. Dainotti, A., A. Pescape, and, A. Ventre, (2007) Worm traffic analysis and characterization, Proceedings of the IEEE International Conference on Communications 2007- ICC 2007, 24-28 June 2007, Glasgow, Scotland, pp. 1435-1442.
6. Daudet, L., (2010) Audio sparse decompositions in parallel, IEEE Signal Processing Magazine, 27, 90-96.
7. Defense Advanced Research Projects Agency (DARPA), Intrusion Detection Evaluation Data Set. Available at (accessed December 2010).
8. Esposito, M., C. Mazzariello, F. Oliviero, S.P. Romano, and, C. Sansone, (2005a) Evaluating pattern recognition techniques in intrusion detection systems, Proceedings of the 5th Workshop on Pattern Recognition in Information Systems (PRIS '05), 24-25 May, Miami, FL, USA, pp. 144-153.
9. Esposito, M., C. Mazzariello, F. Oliviero, S.P. Romano, and, C. Sansone, (2005b) Real time detection of novel attacks by means of data mining techniques, Proceedings of the 7th International Conference on Enterprise Information Systems, 24-28 May, Miami, pp. 120-127.
10. Figueras, R.M., P. Vandergheynst, and, P. Frossard, (2006) Low-rate and flexible image coding with redundant representations, IEEE Transactions on Image Processing, 15, 726-739.
11. Grossman, A., and, J. Morlet, (1985) Decompositions of functions into wavelets of constant shape, and related transforms, mathematics and physics: lectures an recent results, in Mathematics and Physics Lectures on Recent Results, L. Streit (ed.), Singapore: World Scientific, 135-165.
12. Huang, P., A. Feldmann, and, W. Willinger, (2001) A non-intrusive, wavelet-based approach to detecting network performance problems, ACM SIGCOMM Internet Measurement Workshop, 27-31 August 2001, San Diego, CA.
13. Jost, P., P. Vandergheynst, and, P. Frossard, (2005) Tree-based pursuit: algorithm and properties. Swiss Federal Institute of Technology Lausanne (EPFL), Signal Processing Institute Technical Report, TR-ITS-2005.013, 17 May.
14. Lakhina, A., M. Crovella, and, CH. Diot, (2004) Characterization of network-wide anomalies in traffic flows, Proceedings of the 4th ACM SIGCOMM Conference on Internet Measurement 2004, 25-27 October, Taormina, Sicily, Italy, pp. 201-206.
15. Li, L., and, G. Lee, (2003) DDos attack detection and wavelets, International Conference on Computer Communications and Networks IEEE (ICCCN'03), 20-22 October 2003, Dallas, TX, pp. 421-427.
16. Lu, W., and, A.A. Ghorbani, (2009) Network anomaly detection based on wavelet analysis, EURASIP Journal on Advances in Signal Processing, 2009, doi: 10.1155/2009/837601.
17. Mallat, S., and, Z. Zhang, (1993) Matching Pursuit with time-frequency dictionaries, IEEE Transactions on Signal Processing, 41, 3397-3415.
18. Neff, R., and, A. Zakhor, (2002) Matching Pursuit video coding-part I: dictionary approximation, IEEE Transactions on Circuits and Systems for Video Technology, 12, 13-26.
19. Saganowski, L., M. Chorał, R. Renk, and, W. Holubowicz, (2009) A novel signal-based approach to anomaly detection in IDS systems, in ICANNGA 2009, LNCS 5495, M. Kolehmainen, P. Toivanen, and, B. Beliczynski, (eds), Berlin: Springer, 527-536.
20. Shaopeng, S., Y. Junxun, Y. Yongcong, and, A.M. Raed, (2002), A low bit-rate audio coder based on modified sinusoidal model, IEEE 2002 International Conference on Communications, Circuits and Systems and West Sino Expositions Proceedings, 29 June-1 July, Chengdu, China, Vol. 1, pp. 648-652, July.
21. The CAIDA dataset on the Witty worm, Colleen Shanon and David Moore. Available at (accessed 19-24 March 2004).
22. Troop, J.A., (2004) Greed is good: algorithmic results for sparse approximation, IEEE Transactions on Information Theory, 50, 2231-2242.
23. Universita' di Napoli (UNINA) Available at (accessed December 2010).
24. WIDE Project: MAWI Working Group Traffic Archive. Available at (accessed December 2010).
25. Ye, N., Q. Chen, and, S.M. Emran, (2000), Chi-squared statistical profiling for anomaly detection, in Proceedings of the IEEE SMC Inform. Assurance Security Workshop, 6-7 June, West Point, NY, pp. 182-188.