Behavior Analysis of Internet Traffic via Bipartite Graphs and One-Mode Projections

Xu, Kuai; Wang, Feng; Gu, Lin

doi:10.1109/tnet.2013.2264634

Cited by 67 publications

(41 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A similar work is presented by Xu et al [5], who proposed a methodology that analyzes Internet traffic. This methodology first constructs bipartite graphs; after this, it generates onemode projections; then, it builds a similarity matrix and generates clusters with a spectral clustering method; finally, it analyzes the clusters.…”

Section: Related Workmentioning

confidence: 81%

See 1 more Smart Citation

Towards a user network profiling for internal security using top-k rankings similarity measures

Parres-Peredo

Piza-Davila

Cervantes

2017

2017 40th International Conference on Telecommunications and Signal Processing (TSP)

View full text Add to dashboard Cite

Parres-Peredo, Álvaro I.; Piza-Dávila, Hugo I.; Cervantes, Francisco A.I. Parres-Peredo; H.I. Piza-Davila and F. Cervantes (2017). Towards a user network profiling for internal security using top-k rankings similarity measures. Abstract-A major goal of current computer network security systems is to protect the network from outside attackers; however, protecting the network from its own users is still an unattended problem. In campus area networks, the risk of having internal attacks is high because of their topologies and the amount of users. This work proposes a new approach to identify whether a network user is having or not a normal behavior, by analyzing host traffic using top-k ranking similarity measures. The result of this analysis could be an input of intrusion detection systems. The document presents an experiment where real-time traffic of different users in a campus area network is compared to a reference traffic that corresponds to one of them.

show abstract

Section: Related Workmentioning

confidence: 81%

“…Many authors have proposed using network profiles [3]- [5]. However, these works focus on the traffic at the border to build the profiles, losing visibility of internal attacks.…”

Section: Introductionmentioning

confidence: 99%

Towards a user network profiling for internal security using top-k rankings similarity measures

Parres-Peredo

Piza-Davila

Cervantes

2017

2017 40th International Conference on Telecommunications and Signal Processing (TSP)

View full text Add to dashboard Cite

show abstract

“…In the paper, the authors used two clustering methods: -means and method of Cowen and Priebe. Xu et al [21,22] focused on clustering of hosts in the same IP prefixes. They used bipartite graphs to represent hosts' communications in network traffic and described a spectral clustering algorithm for automatic discovery of behaviour clusters in network prefixes based on hosts' communications.…”

Section: Related Workmentioning

confidence: 99%

Network Intrusion Detection with Threat Agent Profiling

Bajtoš

Gajdoš

Kleinova

et al. 2018

Security and Communication Networks

View full text Add to dashboard Cite

With the increase in usage of computer systems and computer networks, the problem of intrusion detection in network security has become an important issue. In this paper, we discuss approaches that simplify network administrator's work. We applied clustering methods for security incident profiling. We consider -means, PAM, and CLARA clustering algorithms. For this purpose, we used data collected in Warden system from various security tools. We do not aim to differentiate between normal and abnormal network traffic, but we focus on grouping similar threat agents based on attributes of security events. We suggest a case of a fine classification and a case of a coarse classification and discuss advantages of both cases.

show abstract

“…Traffic classification methods are used to provide the efficient realization of the data traffic on network resources, to do user analysis by using network data, to manage and plan network resources, to detect the attacks and the abnormalities on the network [1,2]. Recently, the network traffic classification has been frequently used in order to improve service quality in big networks [3,4], use the network effectively, develop new service packets and perform internet traffic analysis [5].…”

Section: Introductionmentioning

confidence: 99%

Network Traffic Classification via Kernel Based Extreme Learning Machine

Ertam

Avcı

2016

ijisae

View full text Add to dashboard Cite

Abstract:The classification of data on the internet in order to make internet use more efficient has an important place especially for network administrators managing corporate networks. Studies for the classification of internet traffic have increased recently. By these studies, it is aimed to increase the quality of service on the network, use the network efficiently, create the service packages and offer them to the users. The first classification method used for the classification of the internet traffic was the classification for the use of port numbers. This classification method has already lost its validity although it was an effective and quick method of classification for the first usage times of the internet. Another classification method used for the classification of network traffic is called as load-based classification or deep packet analysis. This approach is based on the principle of classification by identifying signatures on packets flowing on the network. Another method of classification of the internet traffic which is commonly used in our day and has been also selected for this study is the kernel based on extreme learning machine based approaches. In this study, over 95% was achieved accuracies using different activation functions.

show abstract

Behavior Analysis of Internet Traffic via Bipartite Graphs and One-Mode Projections

Cited by 67 publications

References 20 publications

Towards a user network profiling for internal security using top-k rankings similarity measures

Towards a user network profiling for internal security using top-k rankings similarity measures

Network Intrusion Detection with Threat Agent Profiling

Network Traffic Classification via Kernel Based Extreme Learning Machine

Contact Info

Product

Resources

About