Representativeness analysis and possible applications of partial network data flows

• Autorzy: Bolanowski M. , Paszkiewicz A. , Wroński M. , Żegleń R.
• Języki publikacji: EN

Abstrakty

EN

A new approach to statistical analysis of network flows and its possible application to statistical anomaly detection in high bandwidth communication networks are presented in the paper. The whole data stream was divided into smaller flows using Link Aggregation Control Protocol (LACP). A statistical analysis of the resulting flows shows that a single stream separated from the overall network traffic is representative when it comes to statistical anomaly detection. Such an approach allows the reduction of hardware resources needed to detect anomalies, and makes such a detection possible in high traffic communication systems.

Słowa kluczowe

EN

link aggregation control protocol; network security; network anomaly detection

• Wydawca: Wydawnictwo PAK
• Czasopismo: Measurement Automation Monitoring
• Rocznik: 2016
• Tom: Vol. 62, No. 1
• Strony: 29--32
• Opis fizyczny: Bibliogr. 11 poz., rys., schem., tab., wykr., wzory

Twórcy

autor

Bolanowski M.

• Rzeszów University of Technology, Department of Power Electronics, Power Engineering and Complex Systems, Rzeszów, Poland

autor

Paszkiewicz A.

• Rzeszów University of Technology, Department of Power Electronics, Power Engineering and Complex Systems, Rzeszów, Poland

autor

Wroński M.

• Rzeszów University of Technology, Department of Power Electronics, Power Engineering and Complex Systems, Rzeszów, Poland

autor

Żegleń R.

• Rzeszów University of Technology, Department of Power Electronics, Power Engineering and Complex Systems, Rzeszów, Poland

Bibliografia

• [1] Oshima S., Nakashima T.: Computational Complexity of Anomaly Detection Methods. Seventh International Conference on Broadband, Wireless Computing, Communication and Applications; Victoria, BC, Canada: IEEE, pp. 664-649, 12-14 Nov 2012.
• [2] Feinstein L., Schnackenberg D., Balupari R., Kindred D.: Statistical approaches to DDos attack detection and response. DARPA Information Survivability Conference and Exposition; Washington, DC, USA: IEEE vol. 1, pp. 303–314; 22-24 Apr 2003.
• [3] Nychis G., Sekar V., Andersen D., Kim H., Zhang H.: An empirical evaluation of entropy-based traffic anomaly detection. 8th ACM SIGCOMM Conference on Internet measurement. Vouliagmeni, Greece: ACM New York, NY, USA, pp. 151–156; 20-22 Oct 2008.
• [4] Allen W., Marin G.: On the self-similarity of synthetic traffic for the evaluation of intrusion detection systems. 2003 Symposium on Applications and the Internet. Orlando, FL, USA: IEEE, pp. 242-248; 27-31 Jan 2003.
• [5] Ciftlikli C., Gezer A.: Comparison of Daubechies wavelets for Hurst parameter estimation. Turk J Elec Eng & Comp Sci; vol. 18; pp. 117-128; 2010.
• [6] Cyriac J., Hema A.: Decoupling Non-Stationary and Stationary Components in Long Range Network Time Series in the Context of Anomaly Detection. 37th Annual IEEE Conference on Local Computer Networks. Clearwater Beach, FL, USA: IEEE, pp. 76-84; 22-25 Oct 2012.
• [7] Ciftlikli C., Gezer A., Ozsahin T.: Packet traffic features of IPv6 and IPv4 protocol traffic. Turk J Elec Eng & Comp Sci; vol. 20; pp. 727-749; 2012.
• [8] Manikopoulos C., Papavassiliou S.: Network Intrusion and Fault Detection: A Statistical Anomaly Approach. IEEE Communications Magazine; vol. 40; pp. 76-82; 2002.
• [9] Priestley M.: Spectral Analysis and Time Series. Academic Press 1981.
• [10] Priestley M.: Non-linear and Non-stationary Time Series Analysis. Academic Press, 1988.
• [11] Taqqu M., Teverowsky V., Willinger W.: Estimators for Long-Range Dependance: an Empirical Study. Fractals; vol. 4; pp. 785-788; 1995.

Uwagi

PL

Opracowanie ze środków MNiSW w ramach umowy 812/P-DUN/2016 na działalność upowszechniającą naukę