Detection of denial of service attacks by a non-Gaussian multiresolution model;Détection d'attaques de dénis de service par un modèle non Gaussien multirésolution

CFIP 2006 - Colloque Francophone sur l'Ingenierie des Protocoles

Volumn , Issue , 2006, Pages 349-369

  Borgnat, P ^a   Larrieu, N ^b   Owezarski, P ^b   Abry, P ^a   Aussibal, J ^d   Gallon, L ^d   Dewaele, G ^a   Boudaoud, K ^e   Bernaille, L ^f   Scherrer, A ^c   Zhang, Y ^b   Labit, Y ^b  

^a UNIVERSITÉ DE LYON   (France)

^b LAAS CNRS   (France)

^c UNIV LYON   (France)

^d IUT Mont de Marsan   (France)

^e UNIVERSITY OF NICE SOPHIA ANTIPOLIS   (France)

^f CNRS   (France)

Author keywords

[No Author keywords available]

Indexed keywords

GAUSSIAN NOISE (ELECTRONIC); NETWORK SECURITY; TRANSMISSION CONTROL PROTOCOL;

DETECTION PROBABILITIES; DISTRIBUTED DENIAL OF SERVICE ATTACK; FALSE ALARM PROBABILITY; MARGINAL DISTRIBUTION; MULTI-RESOLUTION MODELING; OBSERVATION WINDOW; STATISTICAL DISTANCE; STATISTICAL PERFORMANCE;

DENIAL-OF-SERVICE ATTACK;

EID: 84926096615     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (17)

1. BARFORD P., KLINE J., PLONKA D., RON A., «A signal analysis of network traffic anomalies», ACM/SIGCOMM Internet Measurement Workshop, Marseille, France, novembre 2002.
2. BASSEVILLE M., «Distance measures for signal processing and pattern recognition», Signal Processing, Vol. 18, 1989, p. 349-369.
3. BRUTLAG J., «Aberrant behavior detection in time series for network monitoring», USENIX System Administration Conference, New Orleans, décembre 2000.
4. EVANS M., HASTINGS N., PEACOCK B., Statistical Distributions, Wiley (Interscience Division), juin 2000.
5. HOCHBERG J., JACKSON K., STALLINGS C., MCCLARY J., DUBOIS D., FORD J., «NADIR: an automated system for detecting network intrusion and misuse», Journal of Computer Security, Vol. 12, no 3, 1993, p. 235-248.
6. HUSSAIN A., HEIDEMANN J., PAPADOPOULOS C., «A framework for classifying denial of service attacks», SIGCOMM, Karlsruhe, Germany, 2003.
7. IPERF - THE TCP/UDP BANDWIDTH MEASUREMENT TOOL, http://dast.nlanr.net/Projects/Iperf/.
8. JAVITS, VALDES, «The SRI IDES Statistical Anomaly Detector», ESORICS, 1991.
9. JUNG J., KRISHNAMURTHY B., RABINOVICH M., «Flash Crowds and Denial of Service Attacks: Characterization and Implications for CDNs and Web Sites», International www Conference, Honolulu, HI, mai 2002.
10. LAKHINA A., CROVELLA M., DIOT C., «Diagnosing Network-Wide Traffic Anomalies», SIGCOMM, août 2004.
11. MOORE D., VOELKER G., SAVAGE S., «Inferring Internet Denial-of-Service activity», Usenix Security Symposium, 2001.
12. PARK K., KIM G., CROVELLA M., «On the relationship between file sizes, transport protocols, and self-similar network traffic», International Conference on Network Protocols, Washington, DC, USA, 1996, IEEE Computer Society, page 171.
13. PAXSON V., «Bro: a system for detecting network intruders in real-time», Computer Networks Journal, Vol. 31, no 23-24, 1999, p. 2435-2463.
14. SCHERRER A., ABRY P., «Marginales non gaussiennes et longue mémoire: analyse et synthèse de trafic Internet», Colloque GRETSI-2005, Louvain-la-Neuve, Belgique, septembre 2005.
15. SCHERRER A., LARRIEU N., BORGNAT P., OWEZARSKI P., ABRY P., «Non Gaussian and Long Memory Statistical Modeling of Internet Traffic», 4th Workshop IPS-MoMe, Salzburg (Austria), février 2006, Salzburg Research, p. 176-185.
16. VACCARO H., LIEPINS G., «Detection of Anomalous Computer Session Activity», IEEE Symposium on Security and Privacy, Oakland, California, mai 1989, p. 280-289.
17. YE N., «A Markov chain model of temporal behavior for anomaly detection», Workshop on Information Assurance and Security, West Point, NY, juin 2000.