Design of a sliding window scheme for detecting high packet-rate flows via random packet sampling

Takanori, Kudo; Takine, Tetsuya

doi:10.1016/j.comnet.2010.12.019

Cited by 4 publications

(11 citation statements)

References 23 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…See InMon sFlow Probe for details. Based on the above, we can formulate the design problem that minimizes the false positive ratio under constraints that (i) the sliding window scheme works as online and (ii) target flows are detected by the maximum allowable detection time T D _ max as follows:

\begin{matrix} left \\ P : max f, \\ s . t . f > 0, \\ m is a natural number, \\ G (f C_{max} T_{BW}) \leq T_{BW}, \end{matrix}

T_{HW} + T_{BW} + G (f C_{max} T_{BW}) \leq T_{D_max}

where T BW = T HW /( mh ).…”

Section: Design Of the Scheme: Minimizing The False Positive Ratiomentioning

confidence: 99%

“…Because the false positive ratio of non-target flows with high-packet rates is very high, our scheme detects those flows before their packet rates have not yet exceeded the threshold. This is a typical phenomenon in sliding window schemes with random packet sampling, as discussed clearly in Kudo and Takine [14]. For reference, we provide Figure 6, which shows the packet rate of flow 7 in the backbone trace data.…”

Section: Backbone Backscattermentioning

confidence: 99%

“…It now follows from the second inequality of equation (C1) and from the first inequality of equation (C2) that m < T HW hG 0 ð Þ ; m > T HW h T D_max À T HW À G 0 ð Þ f g respectively. We thus define a non-empty set M of natural numbers as in (14). Note that under the assumption (15), M≠∅ and problem P for a fixed m is feasible iff m ∈ M. Because G(x) (x ≥ 0) is a positive, strictly increasing function of x, the inverse function G À 1 (Á) of G(Á) exists.…”

Section: Appendix C: Optimal Solution Of Problem Pmentioning

confidence: 99%

“…In on‐line monitoring of traffic, we have to collect information about sampled packets continuously and update the set of sampled packet information to be investigated. Sliding window schemes are typical on‐line data management schemes. In time‐based sliding window schemes, the time window (called sliding window) of fixed length is divided into several unit times (called basic windows), and the sliding window is updated every basic window.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

On‐line detection of persistently high packet‐rate flows via a sliding window scheme with random packet sampling

Takanori

Takine

2013

Int J Network Mgmt

Self Cite

View full text Add to dashboard Cite

SUMMARY We consider on‐line detection of persistently high packet‐rate flows. We assume that flow information is collected via a time‐based sliding window scheme with random packet sampling. In this framework, we propose a method of determining the threshold of the number of sampled packets, which guarantees the false negative ratio. We also formulate and solve the design problem of our scheme, where we aim to minimize the false positive ratio. We then conduct sampling experiments with public trace data and confirm that our method works well as designed. Copyright © 2013 John Wiley & Sons, Ltd.

show abstract

\begin{matrix} left \\ P : max f, \\ s . t . f > 0, \\ m is a natural number, \\ G (f C_{max} T_{BW}) \leq T_{BW}, \end{matrix}

T_{HW} + T_{BW} + G (f C_{max} T_{BW}) \leq T_{D_max}

where T BW = T HW /( mh ).…”

Section: Design Of the Scheme: Minimizing The False Positive Ratiomentioning

confidence: 99%

Section: Backbone Backscattermentioning

confidence: 99%

Section: Appendix C: Optimal Solution Of Problem Pmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

On‐line detection of persistently high packet‐rate flows via a sliding window scheme with random packet sampling

Takanori

Takine

2013

Int J Network Mgmt

Self Cite

View full text Add to dashboard Cite

show abstract

“…Note that packet sampling can reduce memory space and processing cost, and, from this viewpoint, sampling rate is preferred to be as small as possible. On the other hand, sampling techniques inherently suffer from a lack of information about their population [5]. See [7], which discusses the impact of packet sampling on portscan detection schemes.…”

Section: Introductionmentioning

confidence: 99%

Design of a Portscan Detection Scheme with Random Packet Sampling

Takanori¹,

Hamagaki²,

Takine³

2013

Interdisciplinary Research Theory and Technology

Self Cite

View full text Add to dashboard Cite

Abstract. We consider the parameter design of a TCP portscan detection scheme with packet sampling. We assume that anomalous hosts infected by worms or bots perform portscan and generate a large number of scanning TCP flows as well as its usual traffic. We regard a flow consisting of SYN packets only (SYN-only flow) as a portscan flow and attempt to detect hosts who generate θ SYN-only flows or more, where θ denotes the threshold. In this framework, we present a method for determining the threshold of sampled SYN-only flows and the minimum sampling rate under the constraints of the predefined false positive and false negative ratios. We conduct sampling experiments with public trace data and demonstrate the effectiveness of our design.

show abstract

Anomaly detection method for sensor network data streams based on sliding window sampling and optimized clustering

Ling

2019

Safety Science

View full text Add to dashboard Cite

Design of a sliding window scheme for detecting high packet-rate flows via random packet sampling

Cited by 4 publications

References 23 publications

On‐line detection of persistently high packet‐rate flows via a sliding window scheme with random packet sampling

On‐line detection of persistently high packet‐rate flows via a sliding window scheme with random packet sampling

Design of a Portscan Detection Scheme with Random Packet Sampling

Anomaly detection method for sensor network data streams based on sliding window sampling and optimized clustering

Contact Info

Product

Resources

About