Game theory driven monitoring of spatial-aggregated IP-Flow records
Published 1 October 2010
Cynthia Wagner, Gérard Wagener, Radu State, Thomas Engel, Alexandre Dulaunoy
Citations5
Generate an AI Snapshot to get a quick, structured summary of this paper.
Study Snapshot
ObjectiveStudy objective
MethodsResearch methodology
PopulationPopulation studied
Sample sizeSample sizes
OutcomesStudy outcomes here
ResultsStudy results comes here
LimitationsResearch study limitations comes here
A concise AI-generated summary of the paper will appear here once you click Generate AI Snapshot.
TL;DR
A new metric that leverages spatially and temporally aggregated IP-flow related information based on a new kernel function that captures both IP address space distribution as well as volume related traffic information is introduced.
Abstract
An important problem in current operational environments is the large quantity of monitoring data that has to be processed online. This paper introduces a new metric that leverages spatially and temporally aggregated IP-flow related information. The metric is based on a new kernel function that captures both IP address space distribution as well as volume related traffic information. We assess several attacks and counter attack methods with respect to a sound game-theoretical model in order to identify the best Nash Equilibrium driven defensive and offensive strategies.
Keywords
Computer Science
TechnometricsStatistical Learning Theory
26,913 Citations1999Yuhai Wu, Vladimir Vapnik
Presenting a method for determining the necessary and sufficient conditions for consistency of learning process, the author covers function estimates from small data pools, applying these estimations to real-life problems, and much more.
Data Mining and Knowledge DiscoveryA Tutorial on Support Vector Machines for Pattern Recognition
16,433 Citations1998Christopher J. C. Burges
There are several arguments which support the observed high accuracy of SVMs, which are reviewed and numerous examples and proofs of most of the key theorems are given.
Games and Economic BehaviorQuantal Response Equilibria for Normal Form Games
2,613 Citations1995Richard D. McKelvey, Thomas R. Palfrey
Mining anomalies using traffic feature distributions
1,058 Citations2005Anukool Lakhina, Mark Crovella +1 more
It is argued that the distributions of packet features observed in flow traces reveals both the presence and the structure of a wide range of anomalies, and that using feature distributions, anomalies naturally fall into distinct and meaningful clusters that can be used to automatically classify anomalies and to uncover new anomaly types.
BLINC
998 Citations2005Thomas Karagiannis, Konstantina Papagiannaki +1 more
This work presents a fundamentally different approach to classifying traffic flows according to the applications that generate them, based on observing and identifying patterns of host behavior at the transport layer and demonstrates the effectiveness of this approach on three real traces.
Towards highly reliable enterprise network services via inference of multi-level dependencies
373 Citations2007Paramvir Bahl, Ranveer Chandra +4 more
An Inference Graph model is introduced, which is well-adapted to user-perceptible problems rooted in conditions giving rise to both partial service degradation and hard faults, and takes into account multi-level structure, which leads to a 30% improvement in fault localization, as compared to two-level approaches.
Building a better NetFlow
355 Citations2004Cristian Estan, Ken Keys +2 more
Adaptive NetFlow is proposed, deployable through an update to router software, which addresses many shortcomings of NetFlow by dynamically adapting the sampling rate to achieve robustness without sacrificing accuracy.
Mining in a data-flow environment
223 Citations1999Wenke Lee, Salvatore J. Stolfo +1 more
It is shown that in order to minimize the time required in using the classification models in a real-time environment, the “necessary conditions” associated with the lowcost features can be exploited to determine whether some high-cost features need to be computed and the corresponding classification rules need to been checked.
Games and Economic BehaviorA dynamic homotopy interpretation of the logistic quantal response equilibrium correspondence
93 Citations2004Theodore L. Turocy
It is shown that branches of the logistic quantal response equilibrium correspondence may be numerically traversed efficiently and securely and converges to the risk-dominant equilibrium in 2 × 2 games.
Computer NetworksInternet traffic modeling by means of Hidden Markov Models
91 Citations2008Alberto Dainotti, Antonio Pescapè +3 more
The presented experimental analysis shows that the proposed Hidden Markov Model for Internet traffic sources at packet level is able to achieve good results in terms of estimation of statistical parameters and synthetic series generation, taking into account marginal distributions, mutual, and temporal dependencies.
NetFlow
85 Citations2002Robin Sommer, Anja Feldmann
This paper asks the question how and how accurately can one infer information from NetFlow, and is interested in TCP connection summaries and accurately aggregated packet and byte counts.
Lecture notes in computer scienceQuantifying the Extent of IPv6 Deployment
59 Citations2009Elliott Karpilovsky, Alexandre Gerber +3 more
The study suggests that from the vantage points, current IPv6 deployment appears somewhat experimental, and that the growth of IPv6 allocations, routing announcements, and traffic volume probably indicate more operators and users are preparing themselves for the transition to IPv6.
Industrial & Engineering Chemistry ResearchExponentially Weighted Moving Average (EWMA) Control Charts for Monitoring an Analytical Process
54 Citations2007Polona K. Carson, Arthur B. Yeh
Lecture notes in computer scienceHidden Markov Model Modeling of SSH Brute-Force Attacks
50 Citations2009Anna Sperotto, Ramin Sadre +2 more
This paper proposes a flow time series model of SSH brute-force attacks based on Hidden Markov Models and shows that the model successfully emulates an attacker behavior, generating meaningful flow timeseries.
Deposit Once (Technische Universität Berlin)Machine Learning for Application-Layer Intrusion Detection
27 Citations2009Konrad Rieck
The machine learning for application layer intrusion detection book will be the best reason to choose, especially for the students, teachers, doctors, businessman, and other professions who are fond of reading.
Lecture notes in computer sciencePortscan Detection with Sampled NetFlow
25 Citations2009Ignasi Paredes-Oliva, Pere Barlet‐Ros +1 more
It is found that flow sampling is not always better than packet sampling to continue detecting portscans reliably and should be considered as a supplement to packet sampling.
Lecture notes in computer scienceAguri: An Aggregation-Based Traffic Profiler
24 Citations2001Kenjiro Cho, Ryo Kaizaki +1 more
This work proposes a technique to preferentially drop packets from aggregates whose volume is more than the fairshare, and demonstrates its ability to protect the network from DoS attacks and to provide rough fairness among aggregates.
Mining semantic relations using NetFlow
19 Citations2008Alexandru Caracaş, Andreas Kind +3 more
This work introduces a new algorithm based on NetFlow data preprocessed by the Aurora system developed at IBM Research to create a dependency model of the network that describes dependencies among computer systems, software components, and services.
Computer NetworksTraffic monitor deployment in IP networks
19 Citations2009Hui Zang, Antonio Nucci
This paper uses NetFlow as an example and develops a technique to achieve the optimal cost-coverage tradeoff, and aims to solve the Optimal NetFlow Location Problem (ONLP) for a given coverage ratio.
A Framework for Predicting Security and Dependability Measures in Real-time
16 Citations2007Karin Sallhammar, Bjarne E. Helvik +1 more
This thesis proposes a stochastic modeling approach, which can be used to predict a system’s security and dependability behavior, and has a number of possible applications.
Lecture notes in computer scienceCharacteristics of Denial of Service Attacks on Internet Using AGURI
8 Citations2003Ryo Kaizaki, Osamu Nakamura +1 more
Using the traffic pattern aggregation method, AGURI can monitor the flooding attacks in real network traffic for a long term and is used for the monitoring tools.
Detection of denial of service attacks using AGURI
7 Citations2002Ryo Kaizaki, Kenjiro Cho +1 more
The method for automatic detection of the flooding attacks is described and AGURI, that has been developed, is used, using the traffic pattern aggregation method, which can monitor the traffics in a long term and detect flooding attacks.