Correlation among piecewise unwanted traffic time series

Kensuke Fukuda, Toshio Hirotsu, Osamu Akashi, Toshiharu Sugawara

Research output: Chapter in Book/Report/Conference proceedingConference contribution

13 Citations (Scopus)

Abstract

In this paper, we investigate temporal and spatial correlations of time series of unwanted traffic (i.e., darknet or network telescope traffic) in order to estimate statistical behavior of unwanted activities from a small size of darknet address block. First, from the analysis of long-range dependency, we point out that TCP time series has a weak temporal correlation though UDP time series without huge flooding is well-modeled using a Poisson process. Next, we analyze the spatial correlation between two traffic time series divided by different sized darknet address blocks. We confirm that a TCP SYN traffic time series (e.g, virus or worm) has a clear spatial correlation in the arrival of packets between two neighboring address blocks. Indeed, this spatial correlation remains in traffic time series 1,000 addresses far from the target time series, even if a darknet address block is small (e.g., /26). On the other hand, TCP SYNACK traffic (e.g., backscatter) and UDP traffic (e.g., virus or worm) have less spatial correlation between two adjacent large address blocks. Finally, we estimate the average propagation delay of global unwanted activities appearing in TCP SYN traffic by using the generalized inter-correlation coefficient.

Original languageEnglish
Title of host publication2008 IEEE Global Telecommunications Conference, GLOBECOM 2008
Pages1616-1620
Number of pages5
DOIs
Publication statusPublished - 2008 Dec 1
Event2008 IEEE Global Telecommunications Conference, GLOBECOM 2008 - New Orleans, LA, United States
Duration: 2008 Nov 302008 Dec 4

Publication series

NameGLOBECOM - IEEE Global Telecommunications Conference

Conference

Conference2008 IEEE Global Telecommunications Conference, GLOBECOM 2008
CountryUnited States
CityNew Orleans, LA
Period08/11/3008/12/4

ASJC Scopus subject areas

  • Electrical and Electronic Engineering

Fingerprint Dive into the research topics of 'Correlation among piecewise unwanted traffic time series'. Together they form a unique fingerprint.

  • Cite this

    Fukuda, K., Hirotsu, T., Akashi, O., & Sugawara, T. (2008). Correlation among piecewise unwanted traffic time series. In 2008 IEEE Global Telecommunications Conference, GLOBECOM 2008 (pp. 1616-1620). [4698089] (GLOBECOM - IEEE Global Telecommunications Conference). https://doi.org/10.1109/GLOCOM.2008.ECP.314