Reduction of traffic sampling impact on anomaly detection

ICCSE 2012 - Proceedings of 2012 7th International Conference on Computer Science and Education

Volumn , Issue , 2012, Pages 438-443

  Qiao, Pan ^a   Huang, Yong Feng ^a   Zeng, Pei Feng ^a  

^a DONGHUA UNIVERSITY   (China)

Author keywords

Anomaly Detection; High speed Networks; IP Flow; Network Traffic; Sampling

Indexed keywords

ABNORMAL BEHAVIOR; ANOMALY DETECTION; APPROXIMATE METHODS; DATA SOURCE; HIGH-SPEED; IP FLOW; NETWORK ANOMALIES; NETWORK TRAFFIC; PACKET SAMPLING; SAMPLING DATA; SAMPLING MEASUREMENT; TRAFFIC SAMPLING; VARIABLE SAMPLING RATES;

APPROXIMATION THEORY; COMPUTER SCIENCE; EDUCATION COMPUTING; ENGINEERING EDUCATION; HIGH SPEED NETWORKS; SAMPLING;

DATA FLOW ANALYSIS;

EID: 84868110134     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ICCSE.2012.6295109     Document Type: Conference Paper

References (15)

1. nd ACM SIGCOMM Workshop on Internet Measurment: Marseilles, France:71-82, 2002.
2. A. Lakhina, M. Crovella, and C. Diot, "Mining anomalies using traffic feature distributions", ACM SIGCOMM Computer Communication Review, 35(4): 217-228, 2005.
3. A. Sridharan, T. Ye, and S. Bhattacharyya, "Connectionless port scan detection on the backbone", Malware workshop held in conjunction with IPCC: Phoenix, USA, 567-576, 2006.
4. A.Pescapé, D.Rossi, D.Tammaro, S.Valenti, "On the impact of sampling on traffic monitoring and analysis", 22nd International Teletraffic Congress (ITC): Amsterdam, Netherlands, 1-8, 2010.
5. D.Brauckhoff, B.Tellenbach,A. Wagner,M. May,A.Lakhina, "Impact of packet sampling on anomaly detection metrics", Proceedings of the 6th ACM SIGCOMM conference on Internet measurement(IMC):New York, USA, 2006.
6. J. Mai, A. Sridharan, Chen-Nee Chuah, H.Zang, T Ye, "Impact of Packet Sampling on Portscan Detection", IEEE Journal on selected areas in Communications, 24(12): 2285-2298, 2006.
7. J. Mai, C. Chuah, A. Sridharan, T Ye, and H.Zang, "Is sampled data sufficient for anomaly detection?", Proceedings of the 6th ACM SIGCOMM conference on Internet measurement: Rio de Janeriro, Brazil, 165-176, 2006.
8. B. Claise, Specification of the IPFIX protocol for the exchange of IP traffic flow information", http://www.ietf.org/internet-drafts/draft-ietf- ipfix-protocol-24.txt, 2009.
9. T. Zseby, E. Boschi, N. Brownlee, and B. Claise, "IP flow information export (IPFIX) Applicability", http://tools.ietf.org/html/ rfc5472, 2009.
10. Cisco Inc., "Random sampled netflow", http://www.cisco.com/en/ US/products/ps6566/products-feature-guide09186a0080796a49.html, 2010.
11. CAIDA,"CAIDA projects", http://www.caida.org/data/, 2010.
12. C. V. Zhou, C. Leckie, and S. Karunasekera, "A survey of coordinated attacks and collaborative intrusion detection", Computers & Security, 29(1): 124-140, 2010.
13. nd ACM SIGCOMM workshop on Internet Measurement, Marseille, France, 63-68, 2002.
14. J. Apisdorf, K. Claffy, K. Thompson, and R. Wilder, "OC3MON: flexible, affordable, high performance statistics collection", Proceedings of INET'97: Kuala Lumpur, Malaysia, 97-112, 1997.
15. T. Zseby, F. Fokus, M. Molina, and N. Dante, "Sampling and filtering techniques for IP packet selection", http://www.ietf.org/html.charters/ psamp-charter.html, 2008.