Digital signature to help network management using flow analysis

Proença, Mário Lemes; Fernandes, Gilberto; Carvalho, Luiz F.; Assis, Marcos V. O. de; Rodrigues, Joel J. P. C.

doi:10.1002/nem.1892

Cited by 7 publications

(4 citation statements)

References 38 publications

(16 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…These models are suitable if the time series change suddenly, as happens with cloud computing traffic. In this case, an anomaly may be easily diluted inside the time window without compromising the prediction in whole . Moreover, after using DyWiSA with the α optimization, all predictor models have decreased the time and the workload to compute the prediction of the data.…”

Section: Evaluation and Discussionmentioning

confidence: 99%

“…However, predicting network traffic is becoming a more complex task, specially with the surge in traffic that is due to the permanent connectivity of individuals and machines to the Internet . This challenge is even greater in cloud computing because its traffic may suffer sudden changes and the elastic and scalable nature of cloud environments may be easily confused with traffic anomalies, hampering its forecast . In addition, traditional tools for predicting data traffic usually take into account large historical data, therefore being classified as long‐range dependence (LRD) approaches.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Online traffic prediction in the cloud

2016

View full text Add to dashboard Cite

SUMMARYNetwork traffic prediction is a fundamental tool to harness several management tasks, such as monitoring and managing network traffic. Online traffic prediction is usually performed based on large sets of historical data used in training algorithms, for example, to determine the size of static windows to bound the amount of traffic under consideration. However, using large sets of historical data may not be suitable in highly volatile environments, such as cloud computing, where the coupling between time series observations decreases rapidly with time. To fill this gap, this work presents a dynamic window size algorithm for traffic prediction that contains a methodology to optimize a threshold parameter alpha that affects both the prediction and computational cost of our scheme. The alpha parameter defines the minimum data traffic variability needed to justify dynamic window size changes. Thus, with the optimization of this parameter, the number of operations of the dynamic window size algorithm decreases significantly. We evaluate the alpha estimation methodology against several prediction models by assessing the normalized mean square error and mean absolute percent error of predicted values over observed values from two real cloud computing datasets, collected by monitoring the utilization of Dropbox, and a data center dataset including traffic from several common cloud computing services.

show abstract

Section: Evaluation and Discussionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Online traffic prediction in the cloud

2016

View full text Add to dashboard Cite

show abstract

“…Apart from identifying the significant behavior of the hosts in a network, there has already been an effort to identify a significant behavior of the whole segments in a network. Proenca et al create the digital signatures of the network segment using flow analysis in [27]. The authors compare the following methods' performance to create the signature of a network: ant colony algorithm, Holt-Winters exponential smoothing, and principal component analysis.…”

Section: Related Workmentioning

confidence: 99%

Host Behavior in Computer Network: One-Year Study

Jirsík

Velan

2021

IEEE Trans. Netw. Serv. Manage.

View full text Add to dashboard Cite

An analysis of a host behavior is an essential key for modern network management and security. A robust behavior profile enables the network managers to detect anomalies with high accuracy, predict the host behavior, or group host to clusters for better management. Hence, host profiling methods attract the interest of many researchers, and novel methods for host profiling are being introduced. However, these methods are frequently developed on preprocessed and small datasets. Therefore, they do not reflect the real-world artifacts of the host profiling, such as missing observations, temporal patterns, or variability in the profile characteristics in time. To provide the needed insight into the artifacts of host profiling in real-world settings, we present a study of the host behavior in a network conducted on a oneyear-long real-world network dataset. In the study, we inspect the availability of the data for host profiling, identify the temporal patterns in host behavior, introduce a method for stable labeling of the hosts, and assess the variability of the host characteristics in the course of the year using the coefficient of variance. Moreover, we make the one-year dataset containing nine characteristics used for host behavior analysis available for public use and further research, including selected use cases representing host profiling caveats. We also share the record of analyses presented in the paper.

show abstract

“…Thus, a new behavior can be delayed to be recognized. As a result, new patterns in the network data may not be detected rapidly [53]. To address this issue, we used a sliding window.…”

Section: B Ais Detection Modulementioning

confidence: 99%

Artificial Immune Systems and Fuzzy Logic to Detect Flooding Attacks in Software-Defined Networks

et al. 2020

Self Cite

View full text Add to dashboard Cite

Software-defined Networking (SDN) has been discovered as an architecture that uses applications to make networks flexible and centrally controlled. Although SDN provides innovative management, it still susceptible to attacks daily. Traditional detection approaches may not be sufficient to contain these threats. In this paper, we present an Artificial Immune System based IDS named AIS-IDS, which is inspired by the human body's defense cells. AIS-IDS can detect variations in network behavior and identify attacks without prior knowledge about them. Along with AIS, the fuzzy logic is applied on detection to minimize the uncertainty when there is no clear boundary between anomalous and normal traffic behavior. We have simulated portscan and flooding attacks as well as used a public dataset with several types of DDoS attacks to assess our proposal. We compared the AIS-IDS performance with Naive Bayes, k-nearest neighbors, and the Local Outlier Factor. The AIS-IDS outperformed the compared algorithms, achieving f-measure rates 99.97% and 92.28% when submitted to a simulated and a public dataset, respectively.

show abstract

Digital signature to help network management using flow analysis

Cited by 7 publications

References 38 publications

Online traffic prediction in the cloud

Online traffic prediction in the cloud

Host Behavior in Computer Network: One-Year Study

Artificial Immune Systems and Fuzzy Logic to Detect Flooding Attacks in Software-Defined Networks

Contact Info

Product

Resources

About