Diagnosing network-wide traffic anomalies

By Anukool Lakhina, Mark Crovella, Christophe Diot. 2004

1,381 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

Citations in the corpus

Certified Defenses for Data Poisoning Attacks (2017, methodology): “We can also consider defenses beyond the sphere and slab constraints considered here—for instance, sanitizing text data using a language model, or using the covariance structure of the clean data (Lakhina et al., 2004).”
Query Strategies for Evading Convex-Inducing Classifiers (2010, methodology): “…any corner of the ball. convex-inducing classiﬁers include the linear classiﬁers studied by Lowd and Meek (2005), anomaly detectors using bounded PCA (Lakhina et al., 2004) and that use hyper-sphere boundaries (Bishop, 2006), one-class classiﬁers that predict anomalies by thresholding the…”
Differentially-private network trace analysis (2010, background): “For instance, worm fingerprinting [27] (a packet-level analysis) requires raw packet payloads; stepping stone detection [33] (a flow-level analysis) requires addresses and ports in traffic flows; and anomaly detection [13] (a graph-level analysis) requires information on the amount of traffic at ind”
Near-Optimal Evasion of Convex-Inducing Classifiers (2010, methodology): “Convex-inducing classifiers are a natural family to examine as they include linear classifiers, anomaly detection classifiers using bounded PCA (Lakhina et al., 2004), anomaly detection algorithms that use hypersphere boundaries (Bishop, 2006), and other more complicated bodies.”
Anomaly detection in dynamic networks: a survey (2015, methodology): “Vertex detection [55, 56, 67, 106] Subgraph detection [3, 13, 30, 31] Change detection [38] Edge detection [22] Change detection [112] Vertex detection [129] Event detection [68, 72, 75, 77, 83, 84, 93, 113, 114, 115, 122] Change detection [7, 65, 66] Edge detection [1, 80] Subgraph detection [60, 8”
Compromising PCA-based Anomaly Detectors for Network-Wide Traffic (2008, methodology): “Before describing our poisoning attacks, we first define traffic matrices, present our notation, and then summarize the PCA subspace anomaly detection method of [2].”
Detecting and Preventing Cyber Insider Threats: A Survey (2018, background): “ful tool to identify an anomalous volume which, in reality, is deviated significantly from its expected value [97].”
Man vs. Machine: Practical Adversarial Detection of Malicious Crowdsourcing Workers (2014, background): “email spam [35, 36], network intrusion attacks [22, 54], and Internet worms [29].”
Towards Detecting Anomalous User Behavior in Online Social Networks (2014, methodology): “This requires setting thresholds for �xr� 2 2 known as the squared prediction error or SPE [44].”
An empirical comparison of botnet detection methods (2014, methodology): “Lakhina Volume The volume prediction algorithm presented in Lakhina et al. (2004) uses the Principal Components Analysis (PCA) algorithm to build a model of traffic volumes from individual sources.”
Outlier Analysis (2013, methodology): “Some of these methods have also been used in the anomaly detection literature for finding significant changes in stock order data streams [313], or for finding anomalies in network data streams [162, 280, 281].”
An Overview of IP Flow-Based Intrusion Detection (2010, neutral): “[58], [59], [60], [61].”
Online identification and tracking of subspaces from highly incomplete information (2010, background): “Certain patterns of computer network traﬃc including origin-destination ﬂows can be well represented by a subspace model [13].”
MAWILab: combining diverse anomaly detectors for automated anomaly labeling and performance benchmarking (2010, methodology): “Simulating anomalies is also a common way to evaluate an anomaly detector [ 21 , 27, 31, 32].”
Unsupervised real-time anomaly detection for streaming data (2017, methodology): “For instance online variants of principle component analysis (PCA) such as osPCA [40] or window-based PCA [41] can only work with highdimensional, multivariate data streams that can be projected onto a low dimensional”