Generation of high bandwidth network traffic traces

Kamath, P.; Lan, Kun-Chan; Heidemann, John; Bannister, J.; Touch, Joseph D.

doi:10.1109/mascot.2002.1167101

Cited by 22 publications

(16 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Both the MAD and PAD have been characterized using synthetic traces 2 generated from real background traffic and artificial attacks with rates ranging from 60 Mbps to 7 Mbps using the stream merger application [11]. The attack rate is expressed as a percentage of the total traffic, i.e.…”

Section: A Synthetic Tracesmentioning

confidence: 99%

Detection of low-rate attacks in computer networks

Thatte

Mitra

Heidemann³

2008

IEEE INFOCOM 2008 - IEEE Conference on Computer Communications Workshops

View full text Add to dashboard Cite

Abstract-This paper develops two parametric methods to detect low-rate denial-of-service attacks and other similar near-periodic traffic, without the need for flow separation. The first method, the periodic attack detector, is based on a previous approach that exploits the near-periodic nature of attack traffic in aggregate traffic by modeling the peak frequency in the traffic spectrum. The new method adopts simple statistical models for attack and background traffic in the time-domain. Both approaches use sequential probability ratio tests (SPRTs), allowing control over false alarm rate while examining the trade-off between detection time and attack strength. We evaluate these methods with real and synthetic traces, observing that the new Poissonbased scheme uniformly detects attacks more rapidly, often in less than 200ms, and with lower complexity than the periodic attack detector. Current entropy-based detection methods provide an equivalent time to detection but require flow-separation since they utilize source/destination IP addresses. We evaluate sensitivity to attack strength (compared to the rate of background traffic) with synthetic traces, finding that the new approach can detect attacks that represent only 10% of the total traffic bitrate in fractions of a second.

show abstract

Section: A Synthetic Tracesmentioning

confidence: 99%

Detection of low-rate attacks in computer networks

Thatte

Mitra

Heidemann³

2008

IEEE INFOCOM 2008 - IEEE Conference on Computer Communications Workshops

View full text Add to dashboard Cite

show abstract

“…We first create multiple attack streams each consisting of 40 byte UDP packets at an approximately rate 450pkts/sec (saturation capacity of a 128kb/s ADSL uplink). We then create a large attack by merging 50 such attack streams using techniques described by Kamath and Rupp et al [15], [25]. The attack fingerprint has a peak frequency at 22500Hz.…”

Section: H Varying the Network Cross Trafficmentioning

confidence: 99%

Identification of Repeated Denial of Service Attacks

Hussain¹,

Heidemann²,

Papadopoulos³

2006

Proceedings IEEE INFOCOM 2006. 25TH IEEE International Conference on Computer Communications

Self Cite

View full text Add to dashboard Cite

Abstract-Denial of Service attacks have become a weapon for extortion and vandalism causing damages in the millions of dollars to commercial and government sites. Legal prosecution is a powerful deterrent, but requires attribution of attacks, currently a difficult task. In this paper we propose a method to automatically fingerprint and identify repeated attack scenarios-a combination of attacking hosts and attack tool. Such fingerprints not only aid in attribution for criminal and civil prosecution of attackers, but also help justify and focus response measures. Since packet contents can be easily manipulated, we base our fingerprints on the spectral characteristics of the attack stream which are hard to forge. We validate our methodology by applying it to real attacks captured at a regional ISP and comparing the outcome with header-based classification. Finally, we conduct controlled experiments to identify and isolate factors that affect the attack fingerprint.

show abstract

“…First, we utilize RAMP to generate realistic synthetic traffic [2]. Next we demonstrate the use of RAMP to generate synthetic high bandwidth network traces [20]. We then present the results of using RAMP to analyze and model DoS attack traffic [21].…”

Section: Applications Of Rampmentioning

confidence: 99%

“…We would like to thank F. Donelson Smith and Felix Hernandez Campos for providing part of their codes to us for reconstructing HTTP connection information [12]. We would also like to thank Purushotham Kamath, Alefiya Hussain and Debojyoti Dutta for providing helpful feedback from using RAMP in their work [20,21], and Tim Buchheim for helping integrate RAMP with other research activities. Finally, we thank the anonymous reviewers for their valuable comments to help us improve the quality of this paper.…”

Section: Acknowledgementsmentioning

confidence: 99%

A tool for RApid model parameterization and its applications

Lan

Heidemann

2003

Proceedings of the ACM SIGCOMM Workshop on Models, Methods and Tools for Reproducible Network Research - MoMeTools '03

View full text Add to dashboard Cite

The utility of simulations and analysis heavily relies on good models of network traffic. However, it is difficult to model and simulate the Internet traffic because of the network's great heterogeneity and rapid change. The statistical properties of Internet traffic not only constantly change over time but also vary in other dimensions such as locations and directions. Previously we have developed a tool RAMP that supports rapid parameterization of traffic models from live network measurements. In this paper, we first extend RAMP to support near-real-time trace-driven simulation. Next, we demonstrate the applications of RAMP via three case studies: generation of realistic traffic model for simulation, generation of high bandwidth synthetic network traces, and analysis and modeling of malicious traffic. Finally, we discuss some lessons we learned from using RAMP for traffic modeling.

show abstract

Generation of high bandwidth network traffic traces

Cited by 22 publications

References 12 publications

Detection of low-rate attacks in computer networks

Detection of low-rate attacks in computer networks

Identification of Repeated Denial of Service Attacks

A tool for RApid model parameterization and its applications

Contact Info

Product

Resources

About