Loading...
Please wait, while we are loading the content...
Similar Documents
FAMSim,DM.3 A Statistical Approach to TCP Session Classification
| Content Provider | CiteSeerX |
|---|---|
| Author | Brown, Edward D. L. Steel, Andrew M. Lim, Yangkind L. Moscalu, Tudor |
| Abstract | Abstract — Government computer networks need a real-time network traffic monitoring tool to detect anomalies in network traffic patterns to improve security. Specifically, they need a tool to determine if a host is using a network connection for something other than the intended use. A key step in developing this tool is creating statistical models to accurately identify the application protocols of sessions in a network without relying on port numbers, which conventionally identify them. This paper outlines the construction of these models. Specifically, it focuses on the methods used to build them, which included: structuring network data in a database, aggregating packet level data into sessions, and then identifying the key variables. The models employ variables such as the inter-arrival time between packets, the variance of those times, the distribution of TCP control flags and other information available from the packet headers. The paper examines the significance of these explanatory variables and attempts to determine which would be useful in a real-time implementation. E I. |
| File Format | |
| Access Restriction | Open |
| Subject Keyword | Abstract Government Computer Network Network Traffic Pattern Explanatory Variable Statistical Model Packet Header Tcp Control Flag Real-time Network Traffic Network Connection Inter-arrival Time Key Variable Application Protocol Structuring Network Data Packet Level Data Tcp Session Classification Statistical Approach Real-time Implementation Port Number Key Step |
| Content Type | Text |
| Resource Type | Article |
