Using signal processing to analyze wireless data traffic

Partridge, Craig; Cousins, David Bruce; Jackson, Alden W.; Krishnan, Rajesh; Saxena, Tripti; Strayer, W.T.

doi:10.1145/570681.570689

Cited by 59 publications

(34 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Spectral techniques have been employed to identify bottleneck links [7], [8] and routing information [15] as well as a range of network anomalies [1], [12]. Magnaghi et al detect anomalies within TCP flows using a wavelet-based approach to identify network misconfigurations [12].…”

Section: Related Workmentioning

confidence: 99%

Low-rate, flow-level periodicity detection

Bartlett¹,

Heidemann²,

Papadopoulos

2011

2011 IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS)

View full text Add to dashboard Cite

Abstract-As desktops and servers become more complicated, they employ an increasing amount of automatic, non-user initiated communication. Such communication can be good (OS updates, RSS feed readers, and mail polling), bad (keyloggers, spyware, and botnet command-and-control), or ugly (adware or unauthorized peer-to-peer applications). Communication in these applications is often regular, but with very long periods, ranging from minutes to hours. This infrequent communication and the complexity of today's systems makes these applications difficult for users to detect and diagnose. In this paper we present a new approach to identify low-rate periodic network traffic and changes in such regular communication. We employ signal-processing techniques, using discrete wavelets implemented as a fully decomposed, iterated filter bank. This approach not only detects low-rate periodicities, but also identifies approximate times when traffic changed. We implement a self-surveillance application that externally identifies changes to a user's machine, such as interruption of periodic software updates, or an installation of a keylogger.

show abstract

Section: Related Workmentioning

confidence: 99%

Low-rate, flow-level periodicity detection

Bartlett¹,

Heidemann²,

Papadopoulos

2011

2011 IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS)

View full text Add to dashboard Cite

show abstract

“…It utilizes the TCP retransmission timeout events during the opening phase of the TCP connection (Magnaghi et al, 2004). Partridge et al apply Lomb periodograms to retrieve periodicities in wireless communication, including CBR traffic and FTP traffic (Partridge et al, 2002). Kim et al apply wavelet denoising to improve the accuracy of detecting congestion among different flows (Kim et al, 2004).…”

Section: Related Workmentioning

confidence: 99%

“…Thus, we can detect the presence of bottleneck links by detecting the existence of bottleneck traffic in the aggregate traffic in the spectral domain. Our approach builds on top of prior work of spectral analysis of network traffic (Barford et al, 2002;Partridge et al, 2002;Cheng et al, 2002;Hussain et al, 2003).…”

Section: Introductionmentioning

confidence: 99%

Remote detection of bottleneck links using spectral and statistical methods

Papadopoulos

Heidemann

et al. 2009

Computer Networks

View full text Add to dashboard Cite

Persistently saturated links are abnormal conditions that indicate bottlenecks in Internet traffic. Network operators are interested in detecting such links for troubleshooting, to improve capacity planning and traffic estimation, and to detect denial-of-service attacks. Currently bottleneck links can be detected either locally, through SNMP information, or remotely, through active probing or passive flow-based analysis. However, local SNMP information may not be available due to administrative restrictions, and existing remote approaches are not used systematically because of their network or computation overhead. This paper proposes a new approach to remotely detect the presence of bottleneck links using spectral and statistical analysis of traffic. Our approach is passive, operates on aggregate traffic without flow separation, and supports remote detection of bottlenecks, addressing some of the major limitations of existing approaches. Our technique assumes that traffic through the bottleneck is dominated by packets with a common size (typically the maximum transfer unit, for reasons discussed in Section 5.1). With this assumption, we observe that bottlenecks imprint periodicities on packet transmissions based on the packet size and link bandwidth. Such periodicities manifest themselves as strong frequencies in the spectral representation of the aggregate traffic observed at a downstream monitoring point. We propose a detection algorithm based on rigorous statistical methods to detect the presence of bottleneck links by examining strong frequencies in aggregate traffic. We use data from live Internet traces to evaluate the performance of our algorithm under various network conditions. Results show that with proper parameters our algorithm can provide excellent accuracy (up to 95%) even if the traffic through the bottleneck link accounts for less than 10% of the aggregate traffic.

show abstract

“…For example, if there is an underlying low-rate periodic stream in a trace, this will lead to energy appearing at the corresponding frequency in the transform domain. Examples of successful transform-domain techniques include use of the power spectral density [5], wavelets [8], and Lomb periodograms [9]. In each case, a standard analysis tool was used, with the hope that events to be detected would happen to produce a signature in the chosen representation domain.…”

Section: Feature Extraction For Maltraffic Detectionmentioning

confidence: 99%