Correlation among piecewise unwanted traffic time series

Kensuke Fukuda, Toshio Hirotsu, Osamu Akashi, Toshiharu Sugawara

    Research output: Chapter in Book/Report/Conference proceedingConference contribution

    13 Citations (Scopus)

    Abstract

    In this paper, we investigate temporal and spatial correlations of time series of unwanted traffic (i.e., darknet or network telescope traffic) in order to estimate statistical behavior of unwanted activities from a small size of darknet address block. First, from the analysis of long-range dependency, we point out that TCP time series has a weak temporal correlation though UDP time series without huge flooding is well-modeled using a Poisson process. Next, we analyze the spatial correlation between two traffic time series divided by different sized darknet address blocks. We confirm that a TCP SYN traffic time series (e.g, virus or worm) has a clear spatial correlation in the arrival of packets between two neighboring address blocks. Indeed, this spatial correlation remains in traffic time series 1,000 addresses far from the target time series, even if a darknet address block is small (e.g., /26). On the other hand, TCP SYNACK traffic (e.g., backscatter) and UDP traffic (e.g., virus or worm) have less spatial correlation between two adjacent large address blocks. Finally, we estimate the average propagation delay of global unwanted activities appearing in TCP SYN traffic by using the generalized inter-correlation coefficient.

    Original languageEnglish
    Title of host publicationGLOBECOM - IEEE Global Telecommunications Conference
    Pages1616-1620
    Number of pages5
    DOIs
    Publication statusPublished - 2008
    Event2008 IEEE Global Telecommunications Conference, GLOBECOM 2008 - New Orleans, LA
    Duration: 2008 Nov 302008 Dec 4

    Other

    Other2008 IEEE Global Telecommunications Conference, GLOBECOM 2008
    CityNew Orleans, LA
    Period08/11/3008/12/4

    Fingerprint

    Time series
    Viruses
    Telescopes

    ASJC Scopus subject areas

    • Electrical and Electronic Engineering

    Cite this

    Fukuda, K., Hirotsu, T., Akashi, O., & Sugawara, T. (2008). Correlation among piecewise unwanted traffic time series. In GLOBECOM - IEEE Global Telecommunications Conference (pp. 1616-1620). [4698089] https://doi.org/10.1109/GLOCOM.2008.ECP.314

    Correlation among piecewise unwanted traffic time series. / Fukuda, Kensuke; Hirotsu, Toshio; Akashi, Osamu; Sugawara, Toshiharu.

    GLOBECOM - IEEE Global Telecommunications Conference. 2008. p. 1616-1620 4698089.

    Research output: Chapter in Book/Report/Conference proceedingConference contribution

    Fukuda, K, Hirotsu, T, Akashi, O & Sugawara, T 2008, Correlation among piecewise unwanted traffic time series. in GLOBECOM - IEEE Global Telecommunications Conference., 4698089, pp. 1616-1620, 2008 IEEE Global Telecommunications Conference, GLOBECOM 2008, New Orleans, LA, 08/11/30. https://doi.org/10.1109/GLOCOM.2008.ECP.314
    Fukuda K, Hirotsu T, Akashi O, Sugawara T. Correlation among piecewise unwanted traffic time series. In GLOBECOM - IEEE Global Telecommunications Conference. 2008. p. 1616-1620. 4698089 https://doi.org/10.1109/GLOCOM.2008.ECP.314
    Fukuda, Kensuke ; Hirotsu, Toshio ; Akashi, Osamu ; Sugawara, Toshiharu. / Correlation among piecewise unwanted traffic time series. GLOBECOM - IEEE Global Telecommunications Conference. 2008. pp. 1616-1620
    @inproceedings{c69835f464f447efa8ec93f3f9fc1d2e,
    title = "Correlation among piecewise unwanted traffic time series",
    abstract = "In this paper, we investigate temporal and spatial correlations of time series of unwanted traffic (i.e., darknet or network telescope traffic) in order to estimate statistical behavior of unwanted activities from a small size of darknet address block. First, from the analysis of long-range dependency, we point out that TCP time series has a weak temporal correlation though UDP time series without huge flooding is well-modeled using a Poisson process. Next, we analyze the spatial correlation between two traffic time series divided by different sized darknet address blocks. We confirm that a TCP SYN traffic time series (e.g, virus or worm) has a clear spatial correlation in the arrival of packets between two neighboring address blocks. Indeed, this spatial correlation remains in traffic time series 1,000 addresses far from the target time series, even if a darknet address block is small (e.g., /26). On the other hand, TCP SYNACK traffic (e.g., backscatter) and UDP traffic (e.g., virus or worm) have less spatial correlation between two adjacent large address blocks. Finally, we estimate the average propagation delay of global unwanted activities appearing in TCP SYN traffic by using the generalized inter-correlation coefficient.",
    author = "Kensuke Fukuda and Toshio Hirotsu and Osamu Akashi and Toshiharu Sugawara",
    year = "2008",
    doi = "10.1109/GLOCOM.2008.ECP.314",
    language = "English",
    isbn = "9781424423248",
    pages = "1616--1620",
    booktitle = "GLOBECOM - IEEE Global Telecommunications Conference",

    }

    TY - GEN

    T1 - Correlation among piecewise unwanted traffic time series

    AU - Fukuda, Kensuke

    AU - Hirotsu, Toshio

    AU - Akashi, Osamu

    AU - Sugawara, Toshiharu

    PY - 2008

    Y1 - 2008

    N2 - In this paper, we investigate temporal and spatial correlations of time series of unwanted traffic (i.e., darknet or network telescope traffic) in order to estimate statistical behavior of unwanted activities from a small size of darknet address block. First, from the analysis of long-range dependency, we point out that TCP time series has a weak temporal correlation though UDP time series without huge flooding is well-modeled using a Poisson process. Next, we analyze the spatial correlation between two traffic time series divided by different sized darknet address blocks. We confirm that a TCP SYN traffic time series (e.g, virus or worm) has a clear spatial correlation in the arrival of packets between two neighboring address blocks. Indeed, this spatial correlation remains in traffic time series 1,000 addresses far from the target time series, even if a darknet address block is small (e.g., /26). On the other hand, TCP SYNACK traffic (e.g., backscatter) and UDP traffic (e.g., virus or worm) have less spatial correlation between two adjacent large address blocks. Finally, we estimate the average propagation delay of global unwanted activities appearing in TCP SYN traffic by using the generalized inter-correlation coefficient.

    AB - In this paper, we investigate temporal and spatial correlations of time series of unwanted traffic (i.e., darknet or network telescope traffic) in order to estimate statistical behavior of unwanted activities from a small size of darknet address block. First, from the analysis of long-range dependency, we point out that TCP time series has a weak temporal correlation though UDP time series without huge flooding is well-modeled using a Poisson process. Next, we analyze the spatial correlation between two traffic time series divided by different sized darknet address blocks. We confirm that a TCP SYN traffic time series (e.g, virus or worm) has a clear spatial correlation in the arrival of packets between two neighboring address blocks. Indeed, this spatial correlation remains in traffic time series 1,000 addresses far from the target time series, even if a darknet address block is small (e.g., /26). On the other hand, TCP SYNACK traffic (e.g., backscatter) and UDP traffic (e.g., virus or worm) have less spatial correlation between two adjacent large address blocks. Finally, we estimate the average propagation delay of global unwanted activities appearing in TCP SYN traffic by using the generalized inter-correlation coefficient.

    UR - http://www.scopus.com/inward/record.url?scp=67249104170&partnerID=8YFLogxK

    UR - http://www.scopus.com/inward/citedby.url?scp=67249104170&partnerID=8YFLogxK

    U2 - 10.1109/GLOCOM.2008.ECP.314

    DO - 10.1109/GLOCOM.2008.ECP.314

    M3 - Conference contribution

    SN - 9781424423248

    SP - 1616

    EP - 1620

    BT - GLOBECOM - IEEE Global Telecommunications Conference

    ER -