Baseline profile stability for network anomaly detection

International Journal of Network Security

Volumn 6, Issue 1, 2008, Pages 60-66

  Kim, Yoohwan ^a   Jo, Ju Yeon ^a   Suh, Kyunghee Kim ^b  

^a UNIVERSITY OF NEVADA   (United States)

^b AMERICAN INSTITUTES FOR RESEARCH   (United States)

Author keywords

Denial of service attack; Internet traffic profile; Network security

Indexed keywords

ANOMALY-BASED IDS; BASELINE PROFILES; DEFENSE MECHANISM; DENIAL OF SERVICE ATTACKS; INTERNET TRAFFIC; NETWORK ANOMALY DETECTION; NORMAL OPERATIONS; SIGNIFICANT DIFFERENCES;

INTERNET; NETWORK SECURITY; STABILITY;

COMPUTER CRIME;

EID: 84874993569     PISSN: 1816353X     EISSN: 18163548     Source Type: Journal    
DOI: None     Document Type: Article

References (19)

1. J. D. Brutlag, "Aberrant behavior detection in Time Series for Network Monitoring," in the 14th USENIX Conference, pp. 139-146, Dec. 2000.
2. Captus Networks. (http://www.captusnetworks.com)
3. DeepNines Technologies. (http://www.deepnines.com)
4. C. Estan, S. Savage, and G. Varghese, "Automatically inferring patterns of resource consumption innetwork traffic," in Proceedings of 2003 ACM SIGCOMM, pp 137-148, 2003.
5. L. Feinstein, D. Schnackenberg, R. Balupari, and D. Kindred, "Statistical approaches to DDoS attack detection and response," in Proceedings DARPA Information Survivability Conference and Exposition, vol. 1, pp. 303-314, Washington, DC, Apr. 2003.
6. S. Jin, and D. S. Yeung, "A Covariance analysis model for DDoS attack detection," in Proceedings of 2004 IEEE ICC, pp. 1882-1886, 2004.
7. J. Jung, B. Krishnamurthy, and M. Rabinovich, "Flash crowds and denial of service attacks: Characterization and implications for CDNs and web sites," in Proceedings of the International World Wide Web Conference, pp. 252-262, May 2002.
8. Y. Kim, W. C. Lau, M. C. Chuah, and H. J. Chao, "PacketScore: statistics-based overload control against distributed denial-of-service attacks," in Proceedings of IEEE INFOCOM, pp. 2594-2604, Mar. 2004.
9. J. Li, and C. Manikopoulos, "Early statistical anomaly intrusion detection of DOS attacks using MIB traffic parameters," in Proceedings of 2003 IEEE Workshop on Information Assurance, pp. 53-59, June 2003.
10. Q. Li, E. C. Chang, and M. C. Chan, "On the ef- fectiveness of DDoS attacks on statistical filtering," in Proceedings of IEEE INFOCOM, pp. 1373-1383, 2005.
11. D. Liu and F. Huebner, "Application profiling of IP traffic," in Proceedings of the 27th Annual IEEE Conference on Local Computer Networks (LCN), pp. 220-229, 2002.
12. M. Mahoney and P. K. Chan, "Learning nonstationary models of normal network traffic for detecting novel attacks," in Proceedings of ACM 2002 SIGKDD, pp 376-385, 2002.
13. D. Marchette, "A Statistical method for profiling network traffic," in the 1st USENIX Workshop on Intrusion Detection and Network Monitoring, pp. 119-128, Apr. 1999.
14. MAWI Working Group Traffic Archive. (http://tracer.csl.sony.co.jp/mawi)
15. J. Mirkovic, G. Prier, and P. Reiher, "Attacking DDoS at the source," in Proceedings of 10th IEEE International Conference on Network Protocols, pp. 312-321, Nov. 2002.
16. D. Moore, G. M. Voelker, and S. Savage, "Inferring internet denial-of-service activity," in Proceedings of 10th USENIX Security Symposium, pp. 9-22, Aug. 2001.
17. NLANR PMA Internet Packet Trace Data Archive. (http://pma.nlanr.net/Traces)
18. Top Layer Networks. (http://www.toplayer.com)
19. Vsecure Technologies. (http://www.v-secure.com)