Modeling spatial and temporal behavior of Internet traffic anomalies

Bandara, Vidarshana W.; Pezeshki, Ali; Anura, P. Jayasumana

doi:10.1109/lcn.2010.5735749

Cited by 6 publications

(14 citation statements)

References 28 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For example, identifying temporal anomalies in internet traffic 33 and techniques detecting temporal based anomalies in data sources available on UNIX systems. Temporal anomalies occur when data is determined to be irregular if its temporal occurrence is unusual.…”

Section: Related Workmentioning

confidence: 99%

“…Temporal anomalies occur when data is determined to be irregular if its temporal occurrence is unusual. For example, identifying temporal anomalies in internet traffic 33 and techniques detecting temporal based anomalies in data sources available on UNIX systems.…”

Section: Related Workmentioning

confidence: 99%

“…There are different types of anomalies within the research area of SIEM cyber security analysis, which can loosely be categorised as follows: Temporal anomalies occur when data is determined to be irregular if its temporal occurrence is unusual. For example, identifying temporal anomalies in internet traffic and techniques detecting temporal based anomalies in data sources available on UNIX systems. Volume anomalies occur where a spike in the volume of data being monitored and/or logged occurs. For example, detecting volumetric changes in network traffic,() which can be used for security applications such as detecting a high volume of command and control communication, indicative of a malware.…”

Section: Related Workmentioning

confidence: 99%

See 2 more Smart Citations

GraphBAD: A general technique for anomaly detection in security information and event management

Parkinson

Vallati

Crampton

et al. 2018

Concurrency and Computation

View full text Add to dashboard Cite

The reliance on expert knowledge-required for analysing security logs and performing security audits-has created an unhealthy balance, where many computer users are not able to correctly audit their security configurations and react to potential security threats. The decreasing cost of IT and the increasing use of technology in domestic life are exacerbating this problem, where small companies and home IT users are not able to afford the price of experts for auditing their system configuration. In this paper, we present GraphBAD, a graph-based analysis tool that is able to analyse security configurations in order to identify anomalies that could lead to potential security risks. GraphBAD, which does not require any prior domain knowledge, generates graph-based models from security configuration data and, by analysing such models, is able to propose mitigation plans that can help computer users in increasing the security of their systems. A large experimental analysis, conducted on both publicly available (the well-known KDD dataset) and synthetically generated testing sets (file system permissions), demonstrates the ability of GraphBAD in correctly identifying security configuration anomalies and suggesting appropriate mitigation plans. KEYWORDSanomaly detection, graph structure, log files, security auditing, SIEM INTRODUCTIONAuditing security configurations is the process of searching for anomalies that potentially expose a vulnerability of a considered system. The term Security Information and Event Management (SIEM) is often used to describe the process of monitoring audit logs and security configurations to identify vulnerabilities. Given the complexity of the task, there is a heavy reliance on expert knowledge, which is required for understanding the different security configurations. This reliance has two main drawbacks: first, expert knowledge can be incomplete or erroneous; second, the high cost of security experts makes it infeasible for many users to correctly configure the security of their Information Technology (IT) systems. Therefore, in many cases, unseen weaknesses, which can be exploited, will remain in the configuration. Clearly, auditing security configurations is a critical problem for organisations that significantly rely on their IT infrastructure for undertaking business. For this reason, many companies frequently employ a third party security auditing company to examine their IT infrastructure to identify weaknesses and suggest suitable mitigation plans (named as penetration testing 1,2 ). Although businesses are prepared to pay a premium for maintaining their security, the average home IT user or small companies are left to maintain their own IT security. Furthermore, the decreasing cost of IT and the increasing use of technology in domestic life are exacerbating this problem.These limitations are heightened by the following factors. (i) The complexity of computational infrastructure-the cyber-physical platform on which security is attained-is increasing, and the technological landscape i...

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

GraphBAD: A general technique for anomaly detection in security information and event management

Parkinson

Vallati

Crampton

et al. 2018

Concurrency and Computation

View full text Add to dashboard Cite

show abstract

“…Following [28], we consider volume anomalies. The extraction process is described in detail in [29] and is outlined in Appendix. This scheme de-trends to remove normal traffic and applies a threshold to separate anomalies.…”

Section: Anomaly Activity At a Nodementioning

confidence: 99%

“…Graph wavelets [28] enable spatial traffic analysis at different granularities. A graph wavelet-based approach for modelling Internet traffic anomalies is presented in [28], whereas Bandara et al [29] used graph wavelets without losing granularity.…”

Section: Introductionmentioning

confidence: 99%

Spatiotemporal model for Internet traffic anomalies

2014

Self Cite

View full text Add to dashboard Cite

Models for Internet traffic anomalies greatly benefit a range of applications including robust network design, network provisioning and performance studies. A novel approach to analyse and model network traffic anomalies is presented. The proposed approach individually characterises different aspects of anomalies, such as origin, termination, propagation and changes in duration and volume, with common random processes. These characteristics are then integrated into a single model that successfully captures the overall anomaly behaviours. Characterisation of each anomaly property requires only a few parameters, leading to a concise set of parameters for the entire model. Although the model is calibrated with local measurements made at nodes, it successfully represents the global behaviours of anomalies over the network. The proposed model is applicable both at nodal level and at subnet level. This enables hierarchically analysing large and sophisticated networks. Anomalies are analysed using a multi-scale analysis framework based on which, a real-time monitoring system that efficiently communicate ongoing anomaly information across the network is developed. The system is also used for learning regional model parameters distributively. Internet2 traffic data is analysed using the framework, and the corresponding model parameters are derived. These results provide insight on the nature of anomalies in networks.

show abstract