A Framework for Detection of Traffic Anomalies Based on IP Aggregation
スポンサーリンク
概要
- 論文の詳細を見る
Traditional traffic analysis is can be performed online only when detection targets are well specified and are fairly primitive. Local processing at measurement point is discouraged as it would considerably affect major functionality of a network device. When traffic is analyzed at flow level, the notion of flow timeout generates differences in flow lifespan and impedes unbiased monitoring, where only n-top flows ordered by a certain metric are considered. This paper proposes an alternative manner of traffic analysis based on source IP aggregation. The method uses flows as basic building blocks but ignores timeouts, using short monitoring intervals instead. Multidimensional space of metrics obtained through IP aggregation, however, enhances capabilities of traffic analysis by facilitating detection of various anomalous conditions in traffic simultaneously.
- （社）電子情報通信学会の論文
- 2009-01-01
著者
-
ZHANIKEEV Marat
School of International Liberal Studies, Waseda University
-
TANAKA Yoshiaki
Global Information and Telecommunication Institute, Waseda University
-
Zhanikeev Marat
School Of International Liberal Studies Waseda University
-
Tanaka Yoshiaki
Global Information And Telecommunication Institute Waseda University
関連論文
- Effect of incomplete data on delay space dimensionality (情報通信マネジメント)
- Web multimedia throughput: methodology and analysis (ライフインテリジェンスとオフィス情報システム)
- Wavelength multicasting among restricted users in AWG-based WDM PON access network (ネットワークシステム)
- Squeezing Out the Best of End-to-End Performance
- BS-7-7 A Dutch-Auction Pricing Mechanism for Network Congestion Control(BS-7. Network Planning, Control and Management)
- BS-7-36 Processing Overhead in IP Traffic Analysis(BS-7. Network Planning, Control and Management)
- Comparison between two methods of IP traffic analysis (情報通信マネジメント)
- BS-3-3 IP Arrival Processes in Backbone Traffic
- A Two-Stage Simulated Annealing Logical Topology Reconfiguration in IP over WDM Networks(Internet)
- B-6-160 A Logical Topology Reconfiguration with Simulated Annealing in IP over WDM Networks
- SB-10-8 A Fast Neighbour Discovery Simulated Annealing for Logical Topology Design in IP/WDM Networks
- B-6-36 Logical Topology Reconfiguration Trade-off in IP/WDM Optical Networks
- Dynamic Multicast Routing with Predetermined Path Approach for Layered Streams(Traffic Controling CDNs)(Special Issue on Content Delivery Networks)
- Dynamic Bandwidth Allocation System Using English Auction
- A Method to Reduce the External Blocking in the Batcher Banyan Network with Incomplete Copy Network
- Dynamic Multicast Routing Algorithm Using Predetermined Path Search
- Virtual-Cost-Based Algorithm for Dynamic Multicast Routing in Satellite-Terrestrial Networks
- Hash-Based Query Caching Method for Distributed Web Caching in Wide Area Networks (Special Issue on Distributed Processing for Controlling Telecommunications Systems)
- BS-12-33 Simplifying High-Speed Backbone Traffic for Replaying(BS-12. Network Planning, Control, and Management)
- BS-10-12 A Resources Sharing Scheme for Wavelength Multicasting in AWG-based WDM PON(BS-10. Network Planning, Control, and Management)
- BS-4-2 A Design of Wavelengths Multicasting System Supporting Multiple Groups in AWG-based WDM PON(BS-4. System, control and design technologies for emerging network)
- BS-12-4 Wavelength Multicasting Capability of WDM PON Access Network(BS-12. Network Planning, Control, and Management)
- BS-15-2 A Two Stage Heuristic Topology Design Approach for WDM Grid Computing Networks(BS-15.Network Planning, Control, and Management,ENGLISH SESSION)
- Topology Design Strategy for WDM Grid Computing Networks
- BS-8-2 A Tabu Search Method of Logical Topology Design for Wavelength Routed IP Networks(BS-8. Technology and Architecture for Ubiquitous Network Systems,ENGLISH SESSION)
- BS-10-11 A Logical Topology Optimization with Tabu Search in IP over WDM Networks(BS-10. Network Planning, Control, and Management)
- BS-10-8 Meta-Heuristic Logical Topology Optimization in IP over WDM Networks(BS-10. Network Controls for High-Quality Communications)
- BS-7-34 How to Model Terminal Equipment in Simulation(BS-7. Network Planning, Control and Management)
- Things you should know about your Terminal Equipment (情報通信マネジメント)
- BS-3-26 Best Distribution Fitting for Terminal Equipment Performance
- BS-10-2 Distributed Traffic Replay(BS-10. Network Planning, Control, and Management)
- BS-10-1 Analysis of Throughput Reliability in Complex Networks(BS-10. Network Planning, Control, and Management)
- Practical issues with replay of high throughput traffic (情報通信マネジメント)
- Directional active probing in real network services (情報通信マネジメント)
- BS-4-19 Synthesis of Unobtrusive Flash Crowds in Traffic Traces(BS-4. System, control and design technologies for emerging network)
- Efficiency issues in end-to end available bandwidth measurement techniques (テレコミュニケーションマネジメント)
- BS-10-2 End-to-End Available Bandwidth Prediction Using ABsnap and Neural Network
- BS-15-14 Active Measurements in IP over WDM Environment(BS-15.Network Planning, Control, and Management,ENGLISH SESSION)
- BS-15-13 Available Bandwidth Measurement Using Different Probing Patterns(BS-15.Network Planning, Control, and Management,ENGLISH SESSION)
- B-6-111 Reward-Maximized CAC and Routing for Multi-Point Connections
- BS-7-6 Economics of ISP Multi-Homing(BS-7. Network Planning, Control and Management)
- BS-3-27 Oligopoly of Parallel-Serial Network Connectivity
- BS-10-15 An Analysis of ISP Interconnection Market
- BS-4-18 A Model of Two-Stage Game for ISP Peering Networks(BS-4. System, control and design technologies for emerging network)
- BS-12-28 Potential Internet Balkanization as a Dangerous Phenomenon for Telecommunication(BS-12. Network Planning, Control, and Management)
- BS-3-13 Stackelberg Game for Interconnection between Large ISPs and Small ISPs(BS-3. Network Management Technologies for Next Generation Network)
- BS-4-21 Evaluation of Active Probing Tools in Varying Traffic Conditions(BS-4. System, control and design technologies for emerging network)
- BS-12-31 Statistical Analysis of Active Probing Tools(BS-12. Network Planning, Control, and Management)
- BS-3-2 Time Series Analysis for Active Probing Results(BS-3. Network Management Technologies for Next Generation Network)
- BS-10-5 Verifying Quality of Active Measurement Results(BS-10.Network Planning, Control, and Management,symposium)
- Component Analysis in Traffic and Detection of Anomalies(次世代ネットワークとマネジメントシステム技術の潮流及び一般)
- BS-4-11 Path Finding for End-to-End QoS Provisioning(BS-4. Network Design, Management and Control for Future Networked Systems)
- BS-10-12 Pattern Analysis and Modelling of Willingness to Receive Reward for Relay in Ad Hoc Networks(BS-10.Network Planning, Control, and Management,symposium)
- B-6-172 A Wavelength Assignment with Fairness Consideration in Optical Packet Switching Ring Networks
- BS-4-26 Price and Capacity Competition among Large ISPs(BS-4. Network Design, Management and Control for Future Networked Systems)
- BS-4-38 An Advanced Resource Balance-based Link-disjoint Routing in Translucent WDM Optical Networks(BS-4. Network Design, Management and Control for Future Networked Systems)
- BS-4-37 Performance Comparison of Physical Layer Impairment Aware Routing in Translucent WDM Networks(BS-4. Network Design, Management and Control for Future Networked Systems)
- BS-4-24 Comparison between Dutch-Auction Congestion Pricing and Gradient Projection Congestion Pricing(BS-4. Network Design, Management and Control for Future Networked Systems)
- BS-4-4 Admission Control Algorithms Integrated with Pricing for Revenue Optimization in Wireless Local Access Networks(BS-4. Network Design, Management and Control for Future Networked Systems)
- BS-7-8 Pricing of Wireless Local Access Network by Considering Compensation for Collisions(BS-7. Network Planning, Control and Management)
- BS-3-11 Pricing of Wireless Access Network Using Second-Price Auction Protocol
- BS-10-21 Wireless Network Access Market Using Threshold Price Double Auction Protocol
- Adaptive Content Delivery System with Multicasting and Buffering for Heterogeneous Networks(Networks)
- BS-4-8 A Deployable E2E Quality-of-Service Routing Algorithm(BS-4. Network Design, Management and Control for Future Networked Systems)
- BS-10-31 Analogy between Video Bitstream and Traffic Monitoring
- A Framework for Detection of Traffic Anomalies Based on IP Aggregation
- SB-4-5 Advantages of Dynamic End-to-End Bottleneck Probing
- Sensing patterns in one-to-many end-to-end delay space (情報通信マネジメント)
- BS-4-43 Influence of Probing Parameters on Terminal Equipment Performance(BS-4. Network Design, Management and Control for Future Networked Systems)
- A New End-to-End Available Bandwidth Measurement Scheme Using Active Probing
- A New End-to-End Available Bandwidth Measurement Scheme Using Active Probing(サービス管理・ビジネス管理,料金管理,及び一般)
- BS-8-16 An Active End-to-End Available Bandwidth Measurement Scheme(BS-8. Technology and Architecture for Ubiquitous Network Systems,ENGLISH SESSION)
- BS-10-12 Detection of P2P Traffic at Packet Flow Level(BS-10. Network Planning, Control, and Management)
- BS-10-1 Lightweight Discrete Utilization Jitter Estimation(BS-10. Network Planning, Control, and Management)
- BS-10-6 What Do Packet Trains Measure?(BS-10. Network Controls for High-Quality Communications)
- BS-3-4 Packet Flow Based Scheduling Model by Evolutionary Algorithm
- Valuable properties in spatial clustering of end-to-end delay space (情報ネットワーク)
- BS-7-33 Problem of Probing Directionality(BS-7. Network Planning, Control and Management)
- BS-3-3 Sensitivity of Entropy-based Analysis to Detect Infected Hosts(BS-3. Network Management Technologies for Next Generation Network)
- Entropy-based analysis of user IP space (情報ネットワーク)
- BS-7-39 QoS Call Setup for End-to-End QoS Provisioning : Top-Down Approach versus Bottom-Up Approach(BS-7. Network Planning, Control and Management)
- BS-10-9 Detecting Anomalies Using Flow Signature
- BS-8-18 Detection of Anomalies by Analysis of Traffic Components(BS-8. Technology and Architecture for Ubiquitous Network Systems,ENGLISH SESSION)
- BS-10-7 WDM Node Architectures with Limited Range Wavelength Converter Sharing(BS-10. Network Controls for High-Quality Communications)
- BS-10-3 Robust Search Indices From Active Measurement Results
- Can We Find Applications in Multiple-Source Flows?(次世代ネットワークとマネジメントシステム技術の潮流及び一般)
- BS-4-20 Directionality of Packet-Pair Active Probes in Practice(BS-4. System, control and design technologies for emerging network)
- Network positioning for inter-ISP services (情報通信マネジメント)
- BS-3-4 Performance Analysis of Extra-Large Network Simulations(BS-3. Network Management Technologies for Next Generation Network)
- BS-12-32 Accuracy in Overhead-Constrained Network Coordinate Systems(BS-12. Network Planning, Control, and Management)
- BS-12-30 Traffic Statistics of an ISP in Mongolia(BS-12. Network Planning, Control, and Management)
- Dutch Auction for Network Congestion Control
- BS-6-1 QoS Management and Load Balancing in Wireless LANs(BS-6. Planning, Control and Management on Networks and Services)
- Practical models for multi-hop end-to-end network paths (情報通信マネジメント)
- QoS provisioning and load distribution in federated wireless LANs (情報ネットワーク)
- BS-6-45 Congestion-Based Pricing in Differentiated Service Network(BS-6. Planning, Control and Management on Networks and Services)
- BS-3-8 Forward Contract to Solve Demand and Revenue Uncertainty Problem in Network Congestion Management(BS-3. Management and Control Technologies for Innovative Networks)
- BS-3-16 A Price-based Scheme for QoS Management and Load Balancing in Wireless LANs(BS-3. Management and Control Technologies for Innovative Networks)
- On Approximating a Multicast Routing Tree with Multiple Quality-of-Service Constraints
- A Game Theoretic Framework for Bandwidth Allocation and Pricing in Federated Wireless Networks