NADA – Network Anomaly Detection Algorithm

Farraposo, Sílvia; Owezarski, Philippe; Monteiro, Edmundo

doi:10.1007/978-3-540-75694-1_18

Cited by 4 publications

(3 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For example, Fontugne et al [2] introduced a new type of algorithm for detecting anomalies in the Internet traffic by applying the Hough transform [2]. The anomalous traffic flows are detected through behavior-based signatures, similar to the graphical signatures introduced by Farraposo et al [12] for classifying anomalies. The key idea of this technique is that anomalous activities appear as "lines" on temporal-spatial planes, which are easily identified by an edge-detection algorithm.…”

Section: Related Workmentioning

confidence: 98%

Combining sketch and wavelet models for anomaly detection

Pukkawanna

Fukuda

2010

Proceedings of the 2010 IEEE 6th International Conference on Intelligent Computer Communication and Processing

View full text Add to dashboard Cite

Statistics-based anomaly detections have been studied and implemented widely due to their potential to discover unseen anomalies. Several data analyzing techniques such as Wavelet have been successfully applied to this field of research. Wavelet analysis is one of the popular techniques that can be used to extract unusual patterns hidden within time-series data. When combined with the powerful data summarization technique like sketch, it could be able to detection significant changes in network data without any prior knowledge about the targeted traffic. In this paper, we study the anomaly detection approach based on the combination of random projection (sketch) and wavelet analysis. We apply our proposed algorithm to the traffic traces collected on the trans-Pacific transit backbone link (MAWI dataset), and compare it with other algorithms [1] [2], and the port heuristic methodology. The experimental results show that our algorithm can detect and identify a large number of anomalous traffic that are, for example, associated with some malware activities. Moreover, our proposed algorithm is also capable of detecting low-intensity anomalies as well as some types of malicious traffic that cannot be identified by the traditional wavelet analysis.

show abstract

Section: Related Workmentioning

confidence: 98%

Combining sketch and wavelet models for anomaly detection

Pukkawanna

Fukuda

2010

Proceedings of the 2010 IEEE 6th International Conference on Intelligent Computer Communication and Processing

View full text Add to dashboard Cite

show abstract

“…We propose a new approach to detecting anomalies based on pattern recognition, where anomalous traffic flows are detected through behavior-based signatures, similar to the graphical signatures introduced by Farraposo et al [6] for classifying anomalies.…”

Section: Image Processing-based Approachesmentioning

confidence: 99%

“…Thus these anomalies penalize legitimate applications from using optimal resources. Detecting anomalies quickly and accurately in network traffic is a hot topic in the current field of research (e.g., [2,12,14,4,17,9,6,10]). It is essential to characterize network anomalies to be able to identify them.…”

Section: Introductionmentioning

confidence: 99%

An image processing approach to traffic anomaly detection

Fontugne

Hirotsu

Fukuda

2008

Proceedings of the 4th Asian Conference on Internet Engineering

View full text Add to dashboard Cite

This paper discusses the possibility of applying an imageprocessing technique to detecting anomalies in Internet traffic, which is different from traditional techniques of detecting anomalies. We first demonstrate that anomalous packet behavior in darknet traces often has a characteristic multiscale structure in time and space (e.g., in addresses or ports). These observed structures consist of abnormal and non random uses of particular traffic features. From the observations, we propose a new type of algorithm for detecting anomalies based on a technique of pattern recognition. The key idea underlying our algorithm is that anomalous activities appear as "lines" on temporal-spatial planes, which are easily identified by an edge-detection algorithm. Also, the application of a clustering technique to the lines obtained helps in classifying and labeling the numerous anomalies detected. The proposed algorithm was used to blindly analyze packet traffic traces collected from a trans-Pacific transit link. Furthermore, we compared the anomalies detected by our algorithm with those found by a statistical-based algorithm. Consequently, the comparison revealed that the two algorithms found mainly the same anomalies but some were of various different characteristic types.

show abstract

A Database of Anomalous Traffic for Assessing Profile Based IDS

Owezarski

2010

Traffic Monitoring and Analysis

Self Cite

View full text Add to dashboard Cite

NADA – Network Anomaly Detection Algorithm

Cited by 4 publications

References 5 publications

Combining sketch and wavelet models for anomaly detection

Combining sketch and wavelet models for anomaly detection

An image processing approach to traffic anomaly detection

A Database of Anomalous Traffic for Assessing Profile Based IDS

Contact Info

Product

Resources

About