Abstract
Remarkable concerns have been made in recent years towards detecting the network traffic anomalies in order to protect our networks from the persistent threats of DDos and unknown attacks. As a pre-process for many state-of-the-art attack detection technologies, baseline traffic modeling is a prerequisite step to discriminate anomalous flow from normal traffic. In this paper, we analyze the traffic from various network transit points on ISP backbone network and present a baseline traffic model using simple linear regression for the imported NetFlow data; bits per second and flows per second. Our preliminary explorations indicate that the proposed modeling is very effective to recognize anomalous traffic on the real networks.
This is a preview of subscription content, log in via an institution.
Buying options
Tax calculation will be finalised at checkout
Purchases are for personal use only
Learn about institutional subscriptionsPreview
Unable to display preview. Download preview PDF.
References
Foster, J.C.: IDS: Signature versus anomaly detection (2005), http://searchsecurity.techtarget.com
Thottan, M., Ji, C.: Anomaly detection in ip networks. IEEE Transactions on Signal Processing 51, 2191–2204 (2003)
Barford, P., Plonka, D.: Characteristics of network traffic flow anomalies. In: Proceedings of the 1st ACM SIGCOMM Workshop on Internet Measurement, pp. 69–73. ACM, New York (2001)
Brutlag, J.D.: Aberrant behavior detection in time series for network monitoring. In: LISA 2000: Proceedings of the 14th USENIX conference on System administration, pp. 139–146. USENIX Association (2000)
Mahoney, M.V.: Network traffic anomaly detection based on packet bytes. In: SAC 2003: Proceedings of the 2003 ACM symposium on Applied computing, pp. 346–350. ACM, New York (2003)
Anderson, D., Frivold, T., Valdes, A.: Next-generation intrusion-detection expert system (NIDES). Technical Report SRI-CSL-95-07, Computer Science Laboratory, SRI International (1995)
Sperotto, A., Sadre, R., Pras, A.: Anomaly characterization in flow-based traffic time series. In: Akar, N., Pioro, M., Skianis, C. (eds.) IPOM 2008. LNCS, vol. 5275, pp. 15–27. Springer, Heidelberg (2008)
Kim, M.S., Won, Y.J., Hong, J.W.: Characteristic analysis of internet traffic from the perspective of flows. Computer Communications 29, 1639–1652 (2006); Monitoring and Measurements of IP Networks
Montgomery, D., Peck, E.A.: Introduction to Linear Regression Analysis, 2nd edn. John Wiley and Sons, Inc., Chichester (1992)
SPSS: (Spss manual), http://www.spss.com/
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2009 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Cho, Y., Kang, K., Kim, I., Jeong, K. (2009). Baseline Traffic Modeling for Anomalous Traffic Detection on Network Transit Points. In: Hong, C.S., Tonouchi, T., Ma, Y., Chao, CS. (eds) Management Enabling the Future Internet for Changing Business and New Computing Services. APNOMS 2009. Lecture Notes in Computer Science, vol 5787. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-04492-2_39
Download citation
DOI: https://doi.org/10.1007/978-3-642-04492-2_39
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-04491-5
Online ISBN: 978-3-642-04492-2
eBook Packages: Computer ScienceComputer Science (R0)