Detecting anomalous traffic using communication graphs

Keisuke Ishibashi, Tsuyoshi Kondoh, Shigeaki Harada, Tatsuya Mori, Ryoichi Kawahara, Shoichiro Asano

Research output: Contribution to conferencePaperpeer-review

5 Citations (Scopus)

Abstract

We present a method to detect anomalies in a time series of inter-host communication patterns. There are many existing methods for anomaly detection in a time series of traffic volume data, such as number of packets or bytes. However, there is no established method detecting anomalies in a time series of communication patterns that can be represented as graphs. Extracting communication structure enables us to identify low-intensity anomalous network events, e.g., botnet command and control communications, which cannot be detected with conventional volume-based anomaly detection schemes. In this paper, we first define the similarity of two graphs, and then we present a method to detect any anomalous graph that has little similarity with other graphs. This method was evaluated with actual traffic data, and anomalous graphs in which new clusters appeared were detected.

Original languageEnglish
Pages192-197
Number of pages6
Publication statusPublished - 2010
Externally publishedYes
EventWorld Telecommunications Congress 2010, WTC 2010 - Wien, Austria
Duration: 2010 Sep 132010 Sep 14

Conference

ConferenceWorld Telecommunications Congress 2010, WTC 2010
CountryAustria
CityWien
Period10/9/1310/9/14

ASJC Scopus subject areas

  • Computer Networks and Communications

Fingerprint Dive into the research topics of 'Detecting anomalous traffic using communication graphs'. Together they form a unique fingerprint.

Cite this