Detecting anomalous traffic using communication graphs

World Telecommunications Congress 2010, WTC 2010

Volumn , Issue , 2010, Pages 192-197

  Ishibashi, Keisuke ^a   Kondoh, Tsuyoshi ^a   Harada, Shigeaki ^a   Mori, Tatsuya ^a   Kawahara, Ryoichi ^a   Asano, Shoichiro ^b  

^a NTT CORPORATION   (Japan)

^b NATIONAL INSTITUTE OF INFORMATICS   (Japan)

Author keywords

[No Author keywords available]

Indexed keywords

GRAPHIC METHODS; OFFICE BUILDINGS; TIME SERIES;

AS NUMBERS; COMMAND AND CONTROL; COMMUNICATION GRAPHS; COMMUNICATION PATTERN; COMMUNICATION STRUCTURES; LOW-INTENSITY; TRAFFIC DATA; TRAFFIC VOLUME DATA;

ANOMALY DETECTION;

EID: 84870499414     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (17)

1. Snort, http://www.snort.org.
2. V. Paxson, “Bro: A system for detecting network intruders in real-time,” Computer Networks, Vol. 31, Issue 23-24, December 1999.
3. P. Barford, J. Kline, D. Plonka, and A. Ron, “A signal analysis of network traffic anomalies,” in Proc. 2nd ACM SIGCOMM Workshop in Internet Measurement (IMW2002), Marseille, France, October 2002.
4. K. Ishibashi, T. Mori, R. Kawahara, Y. Hirokawa, A. Kobayashi, K. Yamamoto, H. Sakamoto, and S. Asano, “Finding cardinality heavy-hitters in massive traffic data and its application to anomaly detection,” IEICE Trans. Commun., Vol. E91-B, No. 5, pp.1331–1339, May 2008.
5. R. Kawahara, T. Mori, N. Kamiyama, S. Harada, and S. Asano, “A study on detecting network anomalies using sampled flow statistics,” Proc. IEEE SAINT 2007 Workshop, Jan. 2007.
6. A. Lakhina, M. Crovella, and C. Diot, “Mining anomalies using traffic feature distributions,” Proc. ACM SIGCOMM 2005, August 2005.
7. Honeynet Project. Know your Enemy: Tracking Botnets, March 2005. http://www.honeynet.org/papers/bots.
8. T. Holz, M. Steiner, F. Dahl, E. Biersack, and F. Freiling, “Measurements and mitigation of peer-to-peer based botnets: a case study on storm worm,” Proc. 1st Usenix Workshop on Large-Scale Exploits and Emergent Threats, San Francisco, USA, April 2008.
9. K. Ishibashi, T. Mori, R. Kawahara, and K. Toyama, “2-D bitmap for summarizing inter-host communication patterns,” Proc. SAINT 2007 Workshop, Jan. 2007.
10. T. Karagiannis, D. Papagiannaki, and M. Faloutsos, “BLINC: multilevel traffic classification in the dark,” Proc. ACM SIGCOMM 2005, August 2005.
11. M. Iliofotou, P. Pappu, G. Varghese, M. Faloutsos, M. Mitzenmacher, and S. Singh, “Network monitoring using traffic dispersion graphs (TDGs),” to appear in ACM IMC 2007.
12. M. Aida, K. Ishibashi, C. Takano, H. Miwa, K. Muranaka, and A. Miura, “Cluster structures in topology of large-scale social networks revealed by traffic data” Proc. IEEE GLOBECOM 2005, December 2, 2005.
13. H. Kashima, K. Tsuda, and A. Inokuchi, “Marginalized kernels between labeled graphs,” Proc. 20th International Conference on Machine Learning (ICML2003), 2003.
14. T. Gärtner, P. Flach, and S. Wrobel, “On graph kernels: hardness results and efficient alternatives,” Proc. 16th Annual Conference on Computational Learning Theory, August 2003.
15. H. Bunke, P. J. Dickinson, M. Kraetzl, and W. D. Wallis, “A graph-theoretic approach to enterprise network dynamics,” Birkhauser, 2006.
16. T. Ide and H. Kashima, “Eigenspace-based anomaly detection in computer systems,” Proc. 10th ACM SIGKDD Conference (KDD2004), Seattle, USA, 2004.
17. S. P. Borgatti and M. G. Everett, “A graph-theoretic perspective on centrality,” Elsevier Social Networks, Vol. 28, Issue 4, pp. 464–484, October 2006.