Investigating the influence of seasonality and structural breakpoint on telecommunication network traffic prediction

Oduro-Gyimah, Francis Kwabena; Boateng, Kwame Osei

doi:10.1109/icastech.2018.8507112

Cited by 1 publication

(12 citation statements)

References 34 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…First, we compare the performance between LBAT_D(9) and STBAT which are the single source-side attack detection methods. LBAT_D (9) shows relatively higher detection rate and false positive rate than STBAT. That is, LBAT_D (9) aggressively adjusts the detection threshold to detect attack traffic based on the fine grained traffic trend embedding, and it also increases the false positive rate as a side effect.…”

Section: B Performance Comparisonmentioning

confidence: 93%

“…LBAT_D (9) shows relatively higher detection rate and false positive rate than STBAT. That is, LBAT_D (9) aggressively adjusts the detection threshold to detect attack traffic based on the fine grained traffic trend embedding, and it also increases the false positive rate as a side effect. Because of this, LBAT_D (9) and STBAT achieve the similar balanced accuracy when the margin is 4%.…”

Section: B Performance Comparisonmentioning

confidence: 93%

“…In order to understand the impact of burstiness to the proposed method, we evaluate the performance with various margins for the souce-side attack detection methods: LC_LBAT_D(9), WC_LBAT_D (9), LBAT_D (9), and STBAT. Figure 6 shows the performance comparison of the collaborative source-side attack detection methods and the single source-side attack detection methods under 2020 Shanghai DNS request traffic which has highest burst ratio between datasets.…”

Section: B Performance Comparisonmentioning

confidence: 99%

“…That is, LBAT_D (9) aggressively adjusts the detection threshold to detect attack traffic based on the fine grained traffic trend embedding, and it also increases the false positive rate as a side effect. Because of this, LBAT_D (9) and STBAT achieve the similar balanced accuracy when the margin is 4%. However, if the single source-side attack detection get support from multiple sites, the performance of attack detection can show higher performance than the single source-side attack detection method.…”

Section: B Performance Comparisonmentioning

confidence: 99%

“…In linear network traffic in which characteristics such as self-similarity [8], and seasonality [9] are observed, this method show high performance. However, because of unexpected behavior of network users, network traffic may have high jitters with frequent explosive traffic and it show nonlinear properties [10].…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

LSTM-Based Collaborative Source-Side DDoS Attack Detection

2022

View full text Add to dashboard Cite

As denial of service attacks become more sophisticated, the source-side detection techniques are being studied to solve the limitations of target-side detection techniques such as delayed detection and difficulty in tracking attackers. Recently, some source-side detection techniques are being studied to use an adaptive attack detection threshold considering seasonal behavior of network traffic. However, because patterns of network traffic usage have become irregular with increased randomness and explosive traffic, the performance of the adaptive threshold technique has deteriorated. In addition, by limitations of the local view of a single site, distributed attacks from multiple sites may not be detected. In this paper, we propose a LSTM (Long Short Term Memory) based collaborative source-side DDoS (Distributed Denial of Service) attack detection framework which provides the attack detection result of a collaboration network in a global view. The proposed framework applies LSTM-based adaptive thresholds to each source-side network to mitigate performance degradation caused by irregular network traffic behavior. Also, in order to overcome the limitation of performance caused by the local view of single source-side network, the proposed framework constructs a collaborative network through multiple detection sites and aggregates feedback from each site, such as detection rates, local traffic patterns, and timestamp. The collaborative attack detection technique uses the aggregated feedback to determine whether the attack is finally detected and shares the finial detection results with multiple sites. Depending on this final detection result, the adaptive thresholds of each site are reset. Through extensive evaluation of actual network traffic data, the proposed collaborative source-side attack detection technique shows around 15% lower false positive rate than the single source-side attack detection technique while maintaining a high detection rate.

show abstract

Section: B Performance Comparisonmentioning

confidence: 93%