NDLI: Mining anomalies using traffic feature distributions

Please wait, while we are loading the content...

Metarouting

One more bit is enough

OpenDHT: a public DHT service and its uses

Using redundancy to cope with failures in a delay tolerant network

On the predictability of large transfer TCP throughput

Fast hash table lookup using extended bloom filter: an aid to network processing

Mining anomalies using traffic feature distributions

Walking the tightrope: responsive yet stable traffic engineering

Declarative routing: extensible routing with declarative queries

The internet and identifiers

HLP: a next generation inter-domain routing protocol

Limitations of equation-based congestion control

Meridian: a lightweight network location service without virtual coordinates

Idle sense: an optimal access method for high throughput and fairness in rate diverse wireless LANs

Improving accuracy in end-to-end packet loss measurement

Algorithms for advanced packet classification with ternary CAMs

BLINC: multilevel traffic classification in the dark

Rigorous specification and conformance testing techniques for network protocols, as applied to TCP, UDP, and sockets

Towards a global IP anycast service

Implications of autonomy for the expressiveness of policy routing

The power of explicit congestion notification

A case study in building layered DHT applications

ExOR: opportunistic multi-hop routing for wireless networks

Profiling internet backbone traffic: behavior models and applications

Dynamic pipelining: making IP-lookup truly scalable

A DoS-limiting network architecture

Policing congestion response in an internetwork using re-feedback

Towards an evolvable internet architecture

Mining anomalies using traffic feature distributions

Content Provider	ACM Digital Library
Author	Lakhina, Anukool Crovella, Mark Diot, Christophe
Abstract	The increasing practicality of large-scale flow capture makes it possible to conceive of traffic analysis methods that detect and identify a large and diverse set of anomalies. However the challenge of effectively analyzing this massive data source for anomaly diagnosis is as yet unmet. We argue that the distributions of packet features (IP addresses and ports) observed in flow traces reveals both the presence and the structure of a wide range of anomalies. Using entropy as a summarization tool, we show that the analysis of feature distributions leads to significant advances on two fronts: (1) it enables highly sensitive detection of a wide range of anomalies, augmenting detections by volume-based methods, and (2) it enables automatic classification of anomalies via unsupervised learning. We show that using feature distributions, anomalies naturally fall into distinct and meaningful clusters. These clusters can be used to automatically classify anomalies and to uncover new anomaly types. We validate our claims on data from two backbone networks (Abilene and Geant) and conclude that feature distributions show promise as a key element of a fairly general network anomaly diagnosis framework.
Starting Page	217
Ending Page	228
Page Count	12
File Format	PDF
ISBN	1595930094
DOI	10.1145/1080091.1080118
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2005-08-22
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Network-wide traffic analysis Anomaly classification Anomaly detection
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Mining anomalies using traffic feature distributions

Mining anomalies using traffic feature distributions (2005)

Diagnosing network-wide traffic anomalies

Characterization of network-wide anomalies in traffic flows

Feature selection for classification of BGP anomalies using Bayesian models

Online Detection of Network Traffic Anomalies Using Degree Distributions

Resource-aware multi-format network security data storage

Mining anomalies using traffic feature distributions (2005)

Detecting Network-Wide Traffic Anomalies Based on Spatial HMM

Mining anomalies using traffic feature distributions

Similar Documents

Mining anomalies using traffic feature distributions

Mining anomalies using traffic feature distributions (2005)

Diagnosing network-wide traffic anomalies

Characterization of network-wide anomalies in traffic flows

Feature selection for classification of BGP anomalies using Bayesian models

Online Detection of Network Traffic Anomalies Using Degree Distributions

Resource-aware multi-format network security data storage

Mining anomalies using traffic feature distributions (2005)

Detecting Network-Wide Traffic Anomalies Based on Spatial HMM

Mining anomalies using traffic feature distributions