Abnormal event detection for network flooding attacks

Journal of Information Science and Engineering

Volumn 20, Issue 6, 2004, Pages 1079-1091

  Chao, Chi Shih ^a   Chen, Yu Xin ^a   Liu, An Chi ^a  

^a FENG CHIA UNIVERSITY   (Taiwan)

Author keywords

Abnormal traffic event detection; Event correlation; Network flooding attacks; Network security management; Statistical reference window

Indexed keywords

EMBEDDED SYSTEMS; MATHEMATICAL MODELS; MONITORING; PARAMETER ESTIMATION; PATTERN MATCHING; PROBABILITY; ROUTERS; TELECOMMUNICATION TRAFFIC; WORLD WIDE WEB;

ABNORMAL TRAFFIC EVENT DETECTION; EVENT CORRELATION; NETWORK FLOODING ATTACKS; NETWORK SECURITY MANAGEMENT; STATISTICAL REFERENCE WINDOW;

COMPUTER NETWORKS;

EID: 9944222821     PISSN: 10162364     EISSN: None     Source Type: Journal    
DOI: None     Document Type: Conference Paper

References (17)

1. A. Chakrabarti and G. Manimaran, "Internet infrastructure security: a taxonomy," IEEE Network, Vol. 16, 2002, pp. 13-21.
2. J. McHugh, A. Christie, and J. Alien, "Defending yourself: the role of intrusion detection systems," IEEE Software, 2000, pp. 42-46.
3. M. Fisk and G. Varghese, "Fast content-based packet handling for intrusion detection," UCSD Technical Report CS2001-0670, 2001.
4. C. J. Coit, S. Staniford, and J. McAlerney, "Towards faster string matching for intrusion detection or exceeding the speed of snort," in Proceedings of DARPA Information Survivability Conference and Exposition, Vol. 1, 2001, pp. 124-130.
5. Snort 2.0, Open Source Network Intrusion Detection System, http://www.snort.org.
6. R. A. Maxion and F. E. Feather, "A case study of Ethernet anomalies in a distributed computing environment," IEEE Transactions on Reliability, Vol. 39, 1990, pp. 433-443.
7. C. S. Hood and C. Ji, "Proactive network fault detection," in Proceedings of INFOCOM '97, Vol. 3, 1997, pp. 1147-1155.
8. M. Thottan and C. Ji, "Adaptive thresholding for proactive network problem detection," in Proceedings of the 3rd IEEE International Workshops on Systems Management, 1998, pp. 108-116.
9. H. Hiraishi and F. Mizoguchi, "Design of a visual browser for network intrusion detection," in Proceedings of the 10th IEEE International Workshops on Enabling Technologies: Infrastructure for Collaborative Enterprises, 2001, pp. 132-137.
10. R. F. Erbacher, K. L. Walker, and D. A. Frincke, "Intrusion and misuse detection in large-scale systems," IEEE Computer Graphics and Applications, Vol. 22, 2002, pp. 38-47.
11. J. B. D. Cabrera et al., "Proactive detection of distributed denial of service attacks using MIB traffic variables - a feasibility study," in Proceedings of 2001 IEEE/IFIP Integrated Network Management, 2001, pp. 609-622.
12. C. S. Hood and C. Ji, "Beyond thresholds: an alternative method for extracting information from network measurements," in Proceedings of 1997 IEEE Global Telecommunications Conference, Vol. 1, 1997, pp. 487-491.
13. N. Brownlee, "Using NeTraMet for production traffic measurement," in Proceedings of 2001 IEEE/IFIP Integrated Network Management, 2001, pp. 213-226.
14. S. Deng, "Empirical model of www document arrival at access link," in Proceedings of 1996 IEEE International Conference on Communications, Vol. 3, 1996, pp. 1797-1802.
15. C. S. Chao, Y. S. Chen, and A. C. Liu, "Statistical detection for network flooding attacks," in Proceedings of the 2003 National Computer Symposium, 2003, pp. 1264-1273.
16. L. Deri, R. Carbone, and S. Suin, "Monitoring networks using ntop," in Proceedings of 2001 IEEE/IFIP Integrated Network Management, 2001, pp. 199-212.
17. J. Cao et al., "Internet traffic tends to poisson and independent as the load increases," Bell Labs Technical Report, 2001.