Internet activity analysis through proxy log

Bommepally, Kartik; Glisa, T. K.; Prakash, Jeena J.; Singh, Shubra; Murthy, Hema A.

doi:10.1109/ncc.2010.5430163

Cited by 10 publications

(4 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…(ii) Abusive usage: Abusive usage is another common problem with campus networks. Bommepally et al (2010) has found that a large fraction of the Internet access bandwidth is consumed by a small number of users. Prior work in this area (Chu & Chang 2007;Kumar et al 2000;Lin et al 2004;Paine & Griggs 2008) simply counts the bytes for each user to detect abusive usage.…”

Section: Multi-level Anomaly Detectionmentioning

confidence: 99%

“…LANs in university campuses and commercial institutions that access the Internet are faced with the problem of bad Internet experience during peak hours. Bommepally et al (2010) has found that a large fraction of the Internet access bandwidth is consumed by a small number of users. These users need to be controlled so that Internet access can be fair to everyone.…”

Section: Abusive Usage Controlmentioning

confidence: 99%

See 1 more Smart Citation

Multi-level anomaly detection: Relevance of big data analytics in networks

Sait

Bhandari

Khare

et al. 2015

Sadhana

Self Cite

View full text Add to dashboard Cite

The Internet has become a vital source of information; internal and external attacks threaten the integrity of the LAN connected to the Internet. In this work, several techniques have been described for detection of such threats. We have focussed on anomaly-based intrusion detection in the campus environment at the network edge. A campus LAN consisting of more than 9000 users with a 90 Mbps internet access link is a large network. Therefore, efficient techniques are required to handle such big data and to model user behaviour. Proxy server logs of a campus LAN and edge router traces have been used for anomalies like abusive Internet access, systematic downloading (internal threats) and DDoS attacks (external threat); our techniques involve machine learning and time series analysis applied at different layers in TCP/IP stack. Accuracy of our techniques has been demonstrated through extensive experimentation on huge and varied datasets. All the techniques are applicable at the edge and can be integrated into a Network Intrusion Detection System.

show abstract

Section: Multi-level Anomaly Detectionmentioning

confidence: 99%

Section: Abusive Usage Controlmentioning

confidence: 99%

Multi-level anomaly detection: Relevance of big data analytics in networks

Sait

Bhandari

Khare

et al. 2015

Sadhana

Self Cite

View full text Add to dashboard Cite

show abstract

“…They assumed that a user visits multiple related websites, thus enabling cluster formation. [6] analyzed the proxy logs to discover the amount of time spent by user on the Internet, and proposed certain control mechanisms based on the traffic pattern generated.…”

Section: Introductionmentioning

confidence: 99%

URL classification using non negative matrix factorization

Khare

Bhandari

Murthy

2014

2014 Twentieth National Conference on Communications (NCC)

View full text Add to dashboard Cite

Internet availability on a campus is not metered. Internet link bandwidths are vulnerable as they can be misused. Moreover, websites blacklist campuses for misuse. Especially blacklisting by academic websites like IEEE and ACM can lead to serious researchers being denied access to information. The objective of this paper is to proactively classify anomalous accesses. This will enable campus ISPs to deny access to users, misusing the Internet. In particular URLs are classified using the short snippets(meta-data) that are available. New Features, namely random walk term weights, within class popularity in tandem with non negative matrix factorization show a lot of promise for classifying URLs. The classification accuracy is as a high as 92.96% on 10 gigabytes of proxy data.

show abstract

“…A major contributing factor to the consumption of bandwidth (and consequent dissatisfaction on the part of many users) is the excessive use of bandwidth-hungry applications like P2P file sharing and videos [1] [2] by those addicted to Internet surfing. These constitute a minority of the users yet they consume most of the bandwidth [3] [4]. They need to be controlled by suitable bandwidth control policies during peak hours for a better overall user experience.…”

Section: Introductionmentioning

confidence: 99%

User traffic classification for proxy-server based internet access control

Sait

Kumar

Murthy

2012

2012 6th International Conference on Signal Processing and Communication Systems

View full text Add to dashboard Cite

In a LAN, Internet access should be managed weil for a better user experience. Those using a larger share of the bandwidth may be restricted during peak hours to enable others to use the Internet. This can be viewed as a problem of classifying the users based on their Internet usage into normal and high categories, following which control policies may be applied. For this purpose, a proxy-based mechanism has been proposed for classification of users according to the share of their Internet access. The advantage of this approach is that users sharing the same computer can be distinguished by the proxy server and appropriate control policies can be exercised. To understand user behaviour, data is collected at the proxy server in a campus LAN. Machine learning algorithms are then used to learn and characterise user behaviour. In particular, Naive Bayes' and Gaussian Mixture Model based classifiers are used.It is observed that the algorithms are able to scale in that users are clustered into two different groups. Performance evaluation on a held out data set indicates that users can be accurately distinguished 94.96% of the time. The algorithm is also practical since the time consuming task of model building need be done only once a month offiine, while the daily task of classification may be accomplished in a period of 20 mins for GMMs. It has also been shown how the user behavior of the two groups of users may be characterized. This would be a useful aid in the design of policies and algorithms for Internet access control.

show abstract

Internet activity analysis through proxy log

Cited by 10 publications

References 7 publications

Multi-level anomaly detection: Relevance of big data analytics in networks

Multi-level anomaly detection: Relevance of big data analytics in networks

URL classification using non negative matrix factorization

User traffic classification for proxy-server based internet access control

Contact Info

Product

Resources

About