An image processing approach to traffic anomaly detection

Abstract

This paper discusses the possibility of applying an imageprocessing technique to detecting anomalies in Internet traffic, which is different from traditional techniques of detecting anomalies. We first demonstrate that anomalous packet behavior in darknet traces often has a characteristic multiscale structure in time and space (e.g., in addresses or ports). These observed structures consist of abnormal and non random uses of particular traffic features. From the observations, we propose a new type of algorithm for detecting anomalies based on a technique of pattern recognition. The key idea underlying our algorithm is that anomalous activities appear as "lines" on temporal-spatial planes, which are easily identified by an edge-detection algorithm. Also, the application of a clustering technique to the lines obtained helps in classifying and labeling the numerous anomalies detected. The proposed algorithm was used to blindly analyze packet traffic traces collected from a trans-Pacific transit link. Furthermore, we compared the anomalies detected by our algorithm with those found by a statistical-based algorithm. Consequently, the comparison revealed that the two algorithms found mainly the same anomalies but some were of various different characteristic types.

Towards systematic traffic annotation

“…Dashed lines represent the separation in community structure [1]. The green and red circles are alarms reported by a method based on image processing [4], their labels are rough as they stand only for the prominent IP addresses of traffic reported. However, labels within blue circles are the exact IP addresses reported by another method based on gamma modeling [3].…”

“…port number) describe identified anomalies. (2) In previous work [4] we developed an anomaly detector based on image processing that reports events as a set of IP addresses, port numbers and timestamps corresponding to a group of packets identified in analyzed pictures. (3) Several intrusion detection systems take advantage of clustering techniques to identify anomalous traffic [7].…”

“…Algorithms finding community structure [1] helps us in separating those distinct components. For example Figure 2 is a graph of alarms reported by a method based gamma modeling [3] (blue circles) and one based on image processing [4] (red and green circles representing results obtained with distinct parameters). Dashed lines in Figure 2 is the community structure found by the algorithm proposed in [1].…”

Fast Anomaly Detection for Large Data Centers

“…In [9], Lakhina et al use entropy as a summarization tool, and implement automatic classification of anomalies via unsupervised learning. [6] represents multiple pieces of measurements as different colors of an image, enabling uniform processing of multidimensional packet header data. However, they only consider the number of packets for different values of the header field of a packet, e.g., source address, destination address, source port, destination port, etc.…”

“…In our experiment, we employ the adaptive threshold defined in Eqn. (6). and set η = 0.1 by default.…”