Profiling internet backbone traffic
- 22 August 2005
- journal article
- conference paper
- Published by Association for Computing Machinery (ACM) in ACM SIGCOMM Computer Communication Review
- Vol. 35 (4), 169-180
- https://doi.org/10.1145/1090191.1080112
Abstract
Recent spates of cyber-attacks and frequent emergence of applications affecting Internet traffic dynamics have made it imperative to develop effective techniques that can extract, and make sense of, significant communication patterns from Internet traffic data for use in network operations and security management. In this paper, we present a general methodology for building comprehensive behavior profiles of Internet backbone traffic in terms of communication patterns of end-hosts and services. Relying on data mining and information-theoretic techniques, the methodology consists of significant cluster extraction, automatic behavior classification and structural modeling for in-depth interpretive analyses. We validate the methodology using data sets from the core of the Internet. The results demonstrate that it indeed can identify common traffic profiles as well as anomalous behavior patterns that are of interest to network operators and security analysts.Keywords
This publication has 15 references indexed in Scilit:
- Diagnosing network-wide traffic anomaliesPublished by Association for Computing Machinery (ACM) ,2004
- Graphical ModelsStatistical Science, 2004
- A taxonomy of computer wormsPublished by Association for Computing Machinery (ACM) ,2003
- Automatically inferring patterns of resource consumption in network trafficPublished by Association for Computing Machinery (ACM) ,2003
- Internet intrusionsPublished by Association for Computing Machinery (ACM) ,2003
- Sketch-based change detectionPublished by Association for Computing Machinery (ACM) ,2003
- Flash crowds and denial of service attacksPublished by Association for Computing Machinery (ACM) ,2002
- A signal analysis of network traffic anomaliesPublished by Association for Computing Machinery (ACM) ,2002
- Bro: a system for detecting network intruders in real-timeComputer Networks, 1999
- RECONSTRUCTABILITY ANALYSIS OF MULTI-DIMENSIONAL RELATIONS: A Theoretical Basis for Computer-Aided Determination of Acceptable Systems Models †International Journal of General Systems, 1979