Mining anomalies using traffic feature distributions

By Anukool Lakhina, Mark Crovella, Christophe Diot. Conference on Applications, Technologies, Architectures, and Protocols for Computer Communication, 2005

1,343 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications

View Paper: https://www.semanticscholar.org/paper/8855c6fd6652c089958e56eee538937a54edfcea

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

Citations in the corpus

Internet traffic classification demystified: myths, caveats, and the best practices (2008, background): “Unsupervised learning essentially clusters flows with similar characteristics together [16, 26].”
Bayesian Neural Networks for Internet Traffic Classification (2007, background): “, [3], [ 6], [8], [15]) we have been motivated by the desire to test fea ures that are independent of a particular network-configuration ; particularly IP addresses which, even on the same site, can ch ge over time.”
Empirical estimation of entropy functionals with confidence (2010, methodology): “Entropy has also been used in Internet anomaly detection [24] and data and image compression applications [23].”
MAWILab: combining diverse anomaly detectors for automated anomaly labeling and performance benchmarking (2010, methodology): “With real anomalies, researchers evaluate anomaly detectors by manually checking the reported alarms [8, 11, 22, 23], or by comparing them to those reported by other anomaly detectors [14, 21, 22, 23].”
Fast Private Set Operations with SEPIA (2012, background): “For instance, distributed blacklists can be built from set union operations; set intersection allows the identification of common attackers and alerts; and sudden changes in the cardinality of active port or IP address sets are indicative for network anomalies and ongoing attacks [24].”
Anomaly detection: A survey (2009, methodology): “The robust PCA based technique has been applied to the network intrusion detection domain [Shyu et al. 2003; Lakhina et al. 2005; Thottan and Ji 2003] and for detecting anomalies in space craft components [Fujimaki et al.”
An Overview of IP Flow-Based Intrusion Detection (2010, neutral): “[58], [59], [60], [61].”
A survey of coordinated attacks and collaborative intrusion detection (2010, methodology): “…in detail machine learning based data mining methods for intrusion detection, DoS defense and network wide anomaly detection, which have been previously surveyed in (Brugger, 2004; Lee and Stolfo, 2000; Stolfo et al., 2001; Mirkovic and Reiher, 2004; Peng et al., 2006; Lakhina et al., 2004, 2005).”
Revisiting Traffic Anomaly Detection Using Software Defined Networking (2011, background): “However, deployment of ADSs in the network core has been plagued by two problems: 1) Low detection rates : While some systems can provide high detection rates [12], they are not usable in a practical setting because they generate a large number of false positives; 2) Inability to run ADS algorithms ”
Event labeling combining ensemble detectors and background knowledge (2014, background): “1a) a desired detector is applied to the data and then detected events are verified by one or more domain expert(s) [7,15,32,34].”
Embedded Malware Detection Using Markov n-Grams (2008, methodology): “To quantify changes in the n-gram distributions, we use the entropy measure which has been quite effective in quantifying changes in traffic feature distributions [9].”
Profiling internet backbone traffic: behavior models and applications (2005, methodology): “Concurrent with our work, [20, 21] are most similar in spirit, and in a sense are complimentary, to ours.”
Unsupervised Anomaly Detection via Variational Auto-Encoder for Seasonal KPIs in Web Applications (2018, methodology): “For example, the performance of PCA-based anomaly detection [19, 20, 33] is”
An empirical evaluation of entropy-based traffic anomaly detection (2008, methodology): “The .ow-header features are addresses (source and destination), ports (source and destination), and the .ow size distribution (FSD) [10, 5, 9].”
DDoS Attack Detection and Mitigation Using SDN: Methods, Practices, and Solutions (2017, background): “Snortﬂow [43] is one such system that integrates both open ﬂow and SNORT.”