NDLI: Traffic Anomaly Detection at Fine Time Scales with Bayes Nets

Content Provider	IEEE Xplore Digital Library
Author	Kline, J. Sangnam Nam Barford, P. Plonka, D. Ron, A.
Copyright Year	2008
Description	Author affiliation: Dept. of Comput. Sci., Univ. of Wisconsin-Madison, Madison, WI (Kline, J.; Sangnam Nam; Barford, P.; Plonka, D.; Ron, A.)
Abstract	Traffic anomaly detection using high performance measurement systems offers the possibility of improving the speed of detection and enabling detection of important, short-lived anomalies. In this paper we investigate the problem of detecting anomalies using traffic measurements with fine-grained timestamps. We develop a new detection algorithm (called S3) that utilizes a Bayes Net to efficiently consider multiple input signals and to explicitly define what is considered "anomalous''. The input signals considered by S3 are traffic volumes and correlations between ingress/egress packet and bit rates. These complementary signals enable identification of an expanded range of anomalies. Using a set of high precision traffic measurements collected at our campus border router over a 10 month period and an annotated anomaly log supplied by our network operators, we show that S3 is highly accurate, identifying 86% of the anomalies listed in the log. Compared with well known time series-based and wavelet-based detectors, this represents over a 20% improvement inaccuracy. Investigation of events identified by S3 that did not appear in the operator log indicate many are, in fact, true positives. Deployment of S3 in an operational environment supports this by showing zero false positives during initial tests.
Starting Page	37
Ending Page	46
File Size	312129
Page Count	10
File Format	PDF
ISBN	9780769531892
DOI	10.1109/ICIMP.2008.33
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2008-06-29
Publisher Place	Romania
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Measurement Event detection Bit rate Telecommunication traffic Detectors Signal processing anomaly detection Internet Detection algorithms Protection Monitoring
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Traffic anomaly detection at fine time scales with bayes nets (2008).

Massively Parallel Anomaly Detection in Online Network Measurement

Scalable and Efficient Data Streaming Algorithms for Detecting Common Content in Internet Traffic

Towards data mining temporal patterns for anomaly intrusion detection systems

Reduction of False Alarm Rate in Detecting Network Anomaly using Mahalanobis Distance and Similarity Measure

Some results on intrusion and anomaly detection using signal processing and NEAR system

Anomaly Detection Based on Available Bandwidth Estimation

Network traffic anomaly detection using machine learning approaches

Anomaly Detection in network traffic and role of wavelets

Traffic Anomaly Detection at Fine Time Scales with Bayes Nets

Similar Documents

Traffic anomaly detection at fine time scales with bayes nets (2008).

Massively Parallel Anomaly Detection in Online Network Measurement

Scalable and Efficient Data Streaming Algorithms for Detecting Common Content in Internet Traffic

Towards data mining temporal patterns for anomaly intrusion detection systems

Reduction of False Alarm Rate in Detecting Network Anomaly using Mahalanobis Distance and Similarity Measure

Some results on intrusion and anomaly detection using signal processing and NEAR system

Anomaly Detection Based on Available Bandwidth Estimation

Network traffic anomaly detection using machine learning approaches

Anomaly Detection in network traffic and role of wavelets

Traffic Anomaly Detection at Fine Time Scales with Bayes Nets