Scipediacontent: Scipediacontent moved page Draft Content 333987709 to Diot et al 2004a

2021-02-03T17:56:29Z

Scipediacontent moved page Draft Content 333987709 to Diot et al 2004a

Scipediacontent: Created page with " == Abstract == Detecting and understanding anomalies in IP networks is an open and ill-defined problem. Toward this end, we have recently proposed the subspace method for an..."

2021-02-03T17:56:26Z

Created page with " == Abstract == Detecting and understanding anomalies in IP networks is an open and ill-defined problem. Toward this end, we have recently proposed the subspace method for an..."

New page

== Abstract ==

Detecting and understanding anomalies in IP networks is an open and ill-defined problem. Toward this end, we have recently proposed the subspace method for anomaly diagnosis. In this paper we present the first large-scale exploration of the power of the subspace method when applied to flow traffic. An important aspect of this approach is that it fuses information from flow measurements taken throughout a network. We apply the subspace method to three different types of sampled flow traffic in a large academic network: multivariate timeseries of byte counts, packet counts, and IP-flow counts. We show that each traffic type brings into focus a different set of anomalies via the subspace method. We illustrate and classify the set of anomalies detected. We find that almost all of the anomalies detected represent events of interest to network operators. Furthermore, the anomalies span a remarkably wide spectrum of event types, including denial of service attacks (single-source and distributed), flash crowds, port scanning, downstream traffic engineering, high-rate flows, worm propagation, and network outage.

== Original document ==

The different versions of the original document can be found in:

* [http://dx.doi.org/10.1145/1028788.1028813 http://dx.doi.org/10.1145/1028788.1028813]

* [http://www.cs.bu.edu/techreports/pdf/2004-020-traffic-flow-anomalies.pdf http://www.cs.bu.edu/techreports/pdf/2004-020-traffic-flow-anomalies.pdf]

* [https://open.bu.edu/bitstream/handle/2144/1546/2004-020-traffic-flow-anomalies.pdf?sequence=1 https://open.bu.edu/bitstream/handle/2144/1546/2004-020-traffic-flow-anomalies.pdf?sequence=1],
: [http://www.cs.unc.edu/~jeffay/courses/nidsS05/signal-proc/anomalychar-imc04.pdf http://www.cs.unc.edu/~jeffay/courses/nidsS05/signal-proc/anomalychar-imc04.pdf],
: [http://conferences.sigcomm.org/imc/2004/papers/p201-lakhina.pdf http://conferences.sigcomm.org/imc/2004/papers/p201-lakhina.pdf],
: [http://www.cs.princeton.edu/courses/archive/spr05/cos598E/bib/anomalychar-imc04.pdf http://www.cs.princeton.edu/courses/archive/spr05/cos598E/bib/anomalychar-imc04.pdf],
: [http://www.cs.bu.edu/techreports/pdf/2004-020-traffic-flow-anomalies.pdf http://www.cs.bu.edu/techreports/pdf/2004-020-traffic-flow-anomalies.pdf],
: [https://dl.acm.org/citation.cfm?id=1028813 https://dl.acm.org/citation.cfm?id=1028813],
: [http://core.ac.uk/display/24387073 http://core.ac.uk/display/24387073],
: [https://doi.acm.org/10.1145/1028788.1028813 https://doi.acm.org/10.1145/1028788.1028813],
: [https://open.bu.edu/handle/2144/1546 https://open.bu.edu/handle/2144/1546],
: [http://portal.acm.org/citation.cfm?doid=1028788.1028813 http://portal.acm.org/citation.cfm?doid=1028788.1028813],
: [https://conferences2.sigcomm.org/imc/2004/papers/p201-lakhina.pdf https://conferences2.sigcomm.org/imc/2004/papers/p201-lakhina.pdf],
: [https://dblp.uni-trier.de/db/conf/imc/imc2004.html#LakhinaCD04 https://dblp.uni-trier.de/db/conf/imc/imc2004.html#LakhinaCD04],
: [https://doi.org/10.1145/1028788.1028813 https://doi.org/10.1145/1028788.1028813],
: [https://open.bu.edu/bitstream/2144/1546/1/2004-020-traffic-flow-anomalies.pdf https://open.bu.edu/bitstream/2144/1546/1/2004-020-traffic-flow-anomalies.pdf],
: [https://academic.microsoft.com/#/detail/2144936818 https://academic.microsoft.com/#/detail/2144936818]

* [http://dl.acm.org/ft_gateway.cfm?id=1028813&ftid=283943&dwn=1 http://dl.acm.org/ft_gateway.cfm?id=1028813&ftid=283943&dwn=1],
: [http://dx.doi.org/10.1145/1028788.1028813 http://dx.doi.org/10.1145/1028788.1028813]

← Older revision	Revision as of 17:56, 3 February 2021
(No difference)

Diot et al 2004a - Revision history

Scipediacontent: Scipediacontent moved page Draft Content 333987709 to Diot et al 2004a

Scipediacontent: Created page with " == Abstract == Detecting and understanding anomalies in IP networks is an open and ill-defined problem. Toward this end, we have recently proposed the subspace method for an..."