When randomness improves the anomaly detection performance

Callegari, Christian; Gazzarrini, Loris; Giordano, Stefano; Pagano, Michele; Pepe, Teresa

doi:10.1109/isabel.2010.5702782

Cited by 21 publications

(16 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…As far as sketches are concerned, they can not be considered as a detection method, nevertheless they can be used as a building block of several AD systems [6], [8], [10], [11], [12], [13], [14], [2], [15]. Indeed, the use of sketches corresponds to a random aggregation that "efficiently" reduces the dimension of the data (wrt other deterministic aggregations, such as according to input/output routers [2]); moreover, the use of reversible sketches [16] permits to trace back the flows responsible for the anomalies.…”

Section: Ieee International Conference On High Performance Computing mentioning

confidence: 99%

“…From this point of view, the use of sketches present two main advantages: on one hand it gives the possibility of storing big quantities of data, with big memory savings, leading to the development of scalable system and, on the other hand it allows to perform a random aggregation of the traffic flows that has been demonstrated to improve the detection rate of IDSs wrt to "classical" aggregation criteria (e.g., ingress router) [2].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Bivariate Non-parametric Anomaly Detection

Callegari

Giordano

Pagano

2014

2014 IEEE Intl Conf on High Performance Computing and Communications, 2014 IEEE 6th Intl Symp on Cyberspace Safety and Security

Self Cite

View full text Add to dashboard Cite

Detecting anomalous traffic with low false alarm rates is of primary interest in IP networks management.In this paper we propose a novel anomaly detection system, based on a combined use of sketches and of a novel bivariate non-parametric detection method. The latter allows us to simultaneously analyse two different traffic features so as to improve the performance of the "classical" detection systems, in terms of both detection rate and false alarm rate.The preliminary performance analysis, presented in this paper, demonstrates the effectiveness of the proposed system.

show abstract

Section: Ieee International Conference On High Performance Computing mentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Bivariate Non-parametric Anomaly Detection

Callegari

Giordano

Pagano

2014

2014 IEEE Intl Conf on High Performance Computing and Communications, 2014 IEEE 6th Intl Symp on Cyberspace Safety and Security

Self Cite

View full text Add to dashboard Cite

show abstract

“…Sketches can not be considered as a detection method, nevertheless they can be used as a building block of several AD systems [12], [13], [15], [14], [16], [17], [18], [19], [2], [1]. Indeed, the use of sketches corresponds to a random aggregation that "efficiently" reduces the dimension of the data (wrt other deterministic aggregations, such as according to input/output routers [17]); moreover, the use of reversible sketches [20] permits to trace back the flows responsible for the anomalies.…”

Section: Related Workmentioning

confidence: 99%

“…Indeed, the use of sketches corresponds to a random aggregation that "efficiently" reduces the dimension of the data (wrt other deterministic aggregations, such as according to input/output routers [17]); moreover, the use of reversible sketches [20] permits to trace back the flows responsible for the anomalies.…”

Section: Related Workmentioning

confidence: 99%

“…Roughly speaking, sketches are a family of data structures that use the same underlying hashing scheme for summarizing data by means of random aggregations that "efficiently" reduce the dimension of the data (wrt other deterministic aggregations, such as according to input/output routers [17]). They differ in how they update hash buckets and use hashed data to derive estimates.…”

Section: B Multidimensional Sketchesmentioning

confidence: 99%

See 1 more Smart Citation

Sketch-based multidimensional IDS: A new approach for network anomaly detection

Callegari

Casella

Giordano

et al. 2013

2013 IEEE Conference on Communications and Network Security (CNS)

Self Cite

View full text Add to dashboard Cite

The diffusion of technologies for high speed data transmission over the Internet and the growing employment of new multimedia services require fast and effective techniques for the protection against network attacks. In this paper we present a new approach able to detect at the same time different types of network anomalies. It consists in the simultaneous analysis of several traffic descriptors (aggregated through a sketch to guarantee the scalability of the algorithm) by means of a single vectorial algorithm. In terms of ROC curve, the performance of our multidimensional Intrusion Detection System (IDS) are comparable with the separate application of traditional monodimensional IDSs to all traffic parameters, while reducing the computational time of more than 80%.

show abstract