Detecting anomalies in network traffic using maximum entropy estimation

Proceedings of the ACM SIGCOMM Internet Measurement Conference, IMC

Volumn , Issue , 2005, Pages 345-350

  Gu, Yu ^a   McCallum, Andrew ^a   Towsley, Don ^a  

^a Biologically Inspired Neural and Dynamical Systems Laboratory   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

ANOMALY DETECTION METHODS; COMPUTATION TIME; CONSTANT MEMORY; MULTI-DIMENSIONAL VIEW; NETWORK ADMINISTRATOR; NETWORK ANOMALIES; NETWORK TRAFFIC; RELATIVE ENTROPY;

MEASUREMENTS;

MAXIMUM ENTROPY METHODS;

EID: 84878701863     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (15)

1. BARFORD, P., KLINE, J., PLONKA, D., AND RON, A. A signal analysis of network traffic anomalies. In Proceedings of ACM SIG-COMM Internet Measurement Workshop (2002).
2. BRUTLAG, J. D. Aberrant behavior detection in time series for network service monitoring. In Proceeding of the 14th Systems Administration Conference (2000), pp. 139-146.
3. ENDACE. http://www.endace.com.
4. GU, Y., MCCALLUM, A., AND TOWSLEY, D. Detecting anomalies in network traffic using maximum entropy. Tech. rep., Department of Computer Science, UMASS, Amherst, 2005.
5. INTEL CORP. Intel ixp 1200 network processor, 2000.
6. INTERNET ASSIGNED NUMBERS AUTHORITY. http://www.iana.org/assignments/ port-numbers.
7. LEE, W., AND XIANG, D. Information-theoretic measures for anomaly detection. In Proceedings of the IEEE Symposium on Security and Privacy (2001), IEEE Computer Society, p. 130.
8. MALOUF, R. A comparison of algorithms for maximum entropy parameter estimation. In Proceedings of the 6th Conference on Natural Language Learning (2002).
9. MCCALLUM, A. Efficiently inducing features of conditional random fields. In Nineteenth Conference on Uncertainty in Artificial Intelligence (UAI03) (2003).
10. PAXSON, V. Bro: A system for detecting network intruders in realtime.
11. PIETRA, S. D., PIETRA, V. D., AND LAFFERTY, J. Inducing features of random fields. IEEE Transactions on Pattern Analysis and Machine Intelligence 19, 4 (1997), 380-393.
12. SNORT: THE OPEN SOURCE NETWORK INTRUSION DETECTION SYSTEM. http://www.snort.org/.
13. STANIFORD, S., HOAGLAND, J., AND MCALERNEY, J. M. Practical automated detection of stealthy portscans. In Proceedings of the IDS Workshop of the 7th Computer and Communications Security Conference (2000).
14. THOTTAN, M., AND JI, C. Anomaly detection in ip networks. IEEE Trans. Signal Processing 51 (2003).
15. WANG, H., ZHANG, D., AND SHIN, K. G. Detecting syn flooding attacks. In Proceedings of IEEE INFOCOM (2002).