A signal analysis of network traffic anomalies

Abstract

Abstract--Identifying anomalies rapidly and accurately is critical to the efficient operation of large computer networks. Accurately characterizing important classes of anomalies greatly facilitates their identification; however, the subtleties and complexities of anomalous traffic can easily confound this process. In this paper we report results of signal analysis of four classes of network traffic anomalies: outages, flash crowds, attacks and measurement failures. Data for this study consists of IP flow and SNMP measurements collected over a six month period at the border router of a large university. Our results show that wavelet filters are quite effective at exposing the details of both ambient and anomalous traffic. Specifically, we show that a pseudo-spline filter tuned at specific aggregation levels will expose distinct characteristics of each class of anomaly. We show that an effective way of exposing anomalies is via the detection of a sharp increase in the local variance of the filtered data. We evaluate traffic anomaly signals at different points within a network based on topological distance from the anomaly source or destination. We show that anomalies can be exposed effectively even when aggregated with a large amount of additional traffic. We also compare the difference between the same traffic anomaly signals as seen in SNMP and IP flow data, and show that the more coarse-grained SNMP data can also be used to expose anomalies effectively.

Attack Graph Analysis for Network Anti-Forensics

“…The key issue for forensic investigators while during the forensic process is the validation of evidence (Barford et al, 2002). The integrity of the collected evidence has to be questioned at each stage of analysis.…”

“…Current forensics deals with two types of evidence analysis such as live analysis and dead analysis. Live analysis mainly monitors and gathers evidence from live networks and systems (Barford, Kline, Plonka, & Ron, 2002;Sy, 2009) and offline analysis deals with evidence processing after physical or logical imaging of the entire system.…”

“…Necrofile (Barford et al, 2002) rewrites the selected partition or portion of the hard disk with mock data destroying the evidence completely. Active Eraser is another data destruction tool which is used for secure erase of data.…”

Designing an Internet Traffic Predictive Model by Applying a Signal Processing Method

“…wavelet analysis) to internet traffic helps us isolate the characteristics of the traffic by extracting hidden patterns of high and low frequency information [26]. Many researchers used wavelet analysis to identify network anomalies by reconstructing network traffic data [27,28], compressing the data by applying two different thresholds from wavelet coefficients [29], and designing better wavelet filters to identify better local frequency information [30]. In the work by Barford et al [30], wavelet transformations were used to extract flow-based traffic abnormality by splitting the input signals into different ranges of frequencies (low, mid, and high frequencies).…”

Multi Scale Time Series Prediction for Intrusion Detection

“…If the predicted value and observed value differ significantly, an anomaly is detected. While wavelet processing has been employed in intrusion detection (Barford et al, 2002;Kim et al, 2004;Zanero and Savaresi, 2004) and prediction (Brutlag, 2000) has also been used, a combination of these techniques for network intrusion detection is novel.…”