Dynamic application flow cluster based on traffic behavior distance

Peng, Bichen; Guo, Wei; Liu, Daiping; Fu, Jianming

doi:10.1109/icacte.2010.5579013

Cited by 1 publication

(1 citation statement)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…flowscount is #flows from the client-end to server-end within t interval . Euclidean Distance is the most common choice in clustering flow behavior [19,25,26], as authors usually assume data is ditributed in spherical structures. However, we have discovered that most serverside applications constrain the size or type of their returning content of different requests and linear structures dominates our feature space in flow monitoring.…”

Section: Automatic Server Discovery and Access Flowsmentioning

confidence: 99%

Flow-based Anomaly Detection Using Access Behavior Profiling and Time-sequenced Relation Mining

2016

KSII TIIS

View full text Add to dashboard Cite

Emerging attacks aim to access proprietary assets and steal data for business or political motives, such as Operation Aurora and Operation Shady RAT. Skilled Intruders would likely remove their traces on targeted hosts, but their network movements, which are continuously recorded by network devices, cannot be easily eliminated by themselves. However, without complete knowledge about both inbound/outbound and internal traffic, it is difficult for security team to unveil hidden traces of intruders. In this paper, we propose an autonomous anomaly detection system based on behavior profiling and relation mining. The single-hop access profiling model employ a novel linear grouping algorithm PSOLGA to create behavior profiles for each individual server application discovered automatically in historical flow analysis. Besides that, the double-hop access relation model utilizes in-memory graph to mine time-sequenced access relations between different server applications. Using the behavior profiles and relation rules, this approach is able to detect possible anomalies and violations in real-time detection. Finally, the experimental results demonstrate that the designed models are promising in terms of accuracy and computational efficiency.

show abstract

Section: Automatic Server Discovery and Access Flowsmentioning

confidence: 99%

Flow-based Anomaly Detection Using Access Behavior Profiling and Time-sequenced Relation Mining

2016

KSII TIIS

View full text Add to dashboard Cite

show abstract

Dynamic application flow cluster based on traffic behavior distance

Cited by 1 publication

References 8 publications

Flow-based Anomaly Detection Using Access Behavior Profiling and Time-sequenced Relation Mining

Flow-based Anomaly Detection Using Access Behavior Profiling and Time-sequenced Relation Mining

Contact Info

Product

Resources

About