Traffic Anomaly Detection at Fine Time Scales with Bayes Nets

Kline, J.; Nam, Sangnam; Barford, Paul; Plonka, David; Ron, Amos

doi:10.1109/icimp.2008.33

Cited by 18 publications

(9 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Traffic anomaly detections have become an important issue for the network management in the Internet, which have obtained considerable research interests [7], [8], [9], [10], [11], [12]. For the high-profile traffic anomalies, researchers can apply signal analysis methods to detect them [13].…”

Section: Related Workmentioning

confidence: 99%

“…However, the computation overhead at the NOC cannot be reduced by using the above methods. Kline et al [11] utilized Bayes Net to identify potential anomalous traffic from traffic volumes and correlations between ingress/egress packet and bit rates. Also, the temporal correlation was introduced to improve the accuracy of the PCA methods [12].…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Sketch-Based Streaming PCA Algorithm for Network-Wide Traffic Anomaly Detection

Liu

Zhang

Guan

2010

2010 IEEE 30th International Conference on Distributed Computing Systems

View full text Add to dashboard Cite

Internet has become an essential part of the daily life for billions of users worldwide, who are using a large variety of network services and applications everyday. However, there have been serious security problems and network failures that are hard to resolve, for example, botnet attacks, polymorphic worm/virus spreading, DDoS, and flash crowds. To address many of these problems, we need to have a network-wide view of the traffic dynamics, and more importantly, be able to detect traffic anomalies in a timely manner. Spatial analysis methods have been proved to be effective in detecting network-wide traffic anomalies that are not detectable at a single monitor. To our knowledge, Principle Component Analysis (PCA) is the best-known spatial detection method for the coordinated low-profile traffic anomalies. However, existing PCA-based solutions have scalability problems in that they require linear running time and space to analyze the traffic measurements within a sliding window, which makes it often infeasible to be deployed for monitoring large-scale high-speed networks. We propose a sketch-based streaming PCA algorithm for the network-wide traffic anomaly detection in a distributed fashion. Our algorithm only requires logarithmic running time and space at both local monitors and Network Operation Centers (NOCs), and can detect both high-profile and coordinated lowprofile traffic anomalies with bounded errors.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Sketch-Based Streaming PCA Algorithm for Network-Wide Traffic Anomaly Detection

Liu

Zhang

Guan

2010

2010 IEEE 30th International Conference on Distributed Computing Systems

View full text Add to dashboard Cite

show abstract

“…The machine learning algorithms are used to learn the normal behavior of network traffic and then detect the abnormal behaviours (Kline, 2008;Bernaille, 2007).…”

Section: Behavior-based Detectionmentioning

confidence: 99%

Taxonomy of Distributed Denial of Service mitigation approaches for cloud computing

Shameli‐Sendi

Pourzandi

Fekih-Ahmed

et al. 2015

Journal of Network and Computer Applications

View full text Add to dashboard Cite

“…It exploits correlations between packet and flow level information, and associates packet level alarms with various features of the flows from the same traffic. Several other methods are introduced to detect traffic anomalies using various features in the network traffic [23][24][25].…”

Section: Network Anomaly Detectionmentioning

confidence: 99%

A data mining system for distributed abnormal event detection in backbone networks

Zhou

2013

Security Comm Networks

View full text Add to dashboard Cite

Detecting distributed abnormal events has become an increasingly significant task for efficient network management and operation. However, it is still challenging to uncover these distributed behaviors in backbone networks because of the voluminous amount of noisy, high-dimensional traffic data. In this paper, we present a novel system for detecting distributed abnormal events in backbone networks. The proposed system emphasizes on detecting distributed correlated abnormal events, which are caused by the same reason. In contrast, existing methods are not able to distinguish correlated abnormal events from the independent abnormal events. In our proposed system, a set of data mining techniques is used for modeling and detecting distributed correlated abnormal events by analyzing the traffic features. Specifically, traffic behavior representation is constructed to define and select traffic features for describing the traffic behaviors of interest, feature clustering is performed to group together similar transformations in each feature, behavioral data mining is employed to discover the most significant patterns in network interactions with respect to typical behavior, and behavior classification is used to expose the behaviors of interest. Experiment results using real traffic data present the effectiveness of our proposed methods for detecting distributed correlated abnormal events in the backbone network.

show abstract

Traffic Anomaly Detection at Fine Time Scales with Bayes Nets

Cited by 18 publications

References 24 publications

Sketch-Based Streaming PCA Algorithm for Network-Wide Traffic Anomaly Detection

Sketch-Based Streaming PCA Algorithm for Network-Wide Traffic Anomaly Detection

Taxonomy of Distributed Denial of Service mitigation approaches for cloud computing

A data mining system for distributed abnormal event detection in backbone networks

Contact Info

Product

Resources

About