Detection accuracy of network anomalies using sampled flow statistics

Ryoichi Kawahara, Keisuke Ishibashi, Tatsuya Mori, Noriaki Kamiyama, Shigeaki Harada, Shoichiro Asano

Research output: Chapter in Book/Report/Conference proceedingConference contribution

7 Citations (Scopus)

Abstract

We investigate the detection accuracy of network anomalies when we use flow statistics obtained through packet sampling. We have already shown, through a case study based on measurement data, that network anomalies generating a huge number of small flows, such as network scans or SYN flooding, become hard to detect when we perform packet sampling. In this paper, we first develop an analytical model that enables us to quantitatively evaluate the effect of packet sampling on the detection accuracy and then investigate why detection accuracy worsens when the packet sampling rate decreases. In addition, we show that, even with a low sampling rate, spatially partitioning the monitored traffic into groups makes it possible to increase the detection accuracy. We also develop a method of determining an appropriate number of partitioned groups and show its effectiveness.

Original languageEnglish
Title of host publicationGLOBECOM - IEEE Global Telecommunications Conference
Pages1959-1964
Number of pages6
DOIs
Publication statusPublished - 2007
Externally publishedYes
Event50th Annual IEEE Global Telecommunications Conference, GLOBECOM 2007 - Washington, DC
Duration: 2007 Nov 262007 Nov 30

Other

Other50th Annual IEEE Global Telecommunications Conference, GLOBECOM 2007
CityWashington, DC
Period07/11/2607/11/30

Fingerprint

Statistics
Sampling
Analytical models

ASJC Scopus subject areas

  • Engineering(all)

Cite this

Kawahara, R., Ishibashi, K., Mori, T., Kamiyama, N., Harada, S., & Asano, S. (2007). Detection accuracy of network anomalies using sampled flow statistics. In GLOBECOM - IEEE Global Telecommunications Conference (pp. 1959-1964). [4411286] https://doi.org/10.1109/GLOCOM.2007.376

Detection accuracy of network anomalies using sampled flow statistics. / Kawahara, Ryoichi; Ishibashi, Keisuke; Mori, Tatsuya; Kamiyama, Noriaki; Harada, Shigeaki; Asano, Shoichiro.

GLOBECOM - IEEE Global Telecommunications Conference. 2007. p. 1959-1964 4411286.

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Kawahara, R, Ishibashi, K, Mori, T, Kamiyama, N, Harada, S & Asano, S 2007, Detection accuracy of network anomalies using sampled flow statistics. in GLOBECOM - IEEE Global Telecommunications Conference., 4411286, pp. 1959-1964, 50th Annual IEEE Global Telecommunications Conference, GLOBECOM 2007, Washington, DC, 07/11/26. https://doi.org/10.1109/GLOCOM.2007.376
Kawahara R, Ishibashi K, Mori T, Kamiyama N, Harada S, Asano S. Detection accuracy of network anomalies using sampled flow statistics. In GLOBECOM - IEEE Global Telecommunications Conference. 2007. p. 1959-1964. 4411286 https://doi.org/10.1109/GLOCOM.2007.376
Kawahara, Ryoichi ; Ishibashi, Keisuke ; Mori, Tatsuya ; Kamiyama, Noriaki ; Harada, Shigeaki ; Asano, Shoichiro. / Detection accuracy of network anomalies using sampled flow statistics. GLOBECOM - IEEE Global Telecommunications Conference. 2007. pp. 1959-1964
@inproceedings{d704196eb4b74a41a0151699b3167ced,
title = "Detection accuracy of network anomalies using sampled flow statistics",
abstract = "We investigate the detection accuracy of network anomalies when we use flow statistics obtained through packet sampling. We have already shown, through a case study based on measurement data, that network anomalies generating a huge number of small flows, such as network scans or SYN flooding, become hard to detect when we perform packet sampling. In this paper, we first develop an analytical model that enables us to quantitatively evaluate the effect of packet sampling on the detection accuracy and then investigate why detection accuracy worsens when the packet sampling rate decreases. In addition, we show that, even with a low sampling rate, spatially partitioning the monitored traffic into groups makes it possible to increase the detection accuracy. We also develop a method of determining an appropriate number of partitioned groups and show its effectiveness.",
author = "Ryoichi Kawahara and Keisuke Ishibashi and Tatsuya Mori and Noriaki Kamiyama and Shigeaki Harada and Shoichiro Asano",
year = "2007",
doi = "10.1109/GLOCOM.2007.376",
language = "English",
isbn = "1424410436",
pages = "1959--1964",
booktitle = "GLOBECOM - IEEE Global Telecommunications Conference",

}

TY - GEN

T1 - Detection accuracy of network anomalies using sampled flow statistics

AU - Kawahara, Ryoichi

AU - Ishibashi, Keisuke

AU - Mori, Tatsuya

AU - Kamiyama, Noriaki

AU - Harada, Shigeaki

AU - Asano, Shoichiro

PY - 2007

Y1 - 2007

N2 - We investigate the detection accuracy of network anomalies when we use flow statistics obtained through packet sampling. We have already shown, through a case study based on measurement data, that network anomalies generating a huge number of small flows, such as network scans or SYN flooding, become hard to detect when we perform packet sampling. In this paper, we first develop an analytical model that enables us to quantitatively evaluate the effect of packet sampling on the detection accuracy and then investigate why detection accuracy worsens when the packet sampling rate decreases. In addition, we show that, even with a low sampling rate, spatially partitioning the monitored traffic into groups makes it possible to increase the detection accuracy. We also develop a method of determining an appropriate number of partitioned groups and show its effectiveness.

AB - We investigate the detection accuracy of network anomalies when we use flow statistics obtained through packet sampling. We have already shown, through a case study based on measurement data, that network anomalies generating a huge number of small flows, such as network scans or SYN flooding, become hard to detect when we perform packet sampling. In this paper, we first develop an analytical model that enables us to quantitatively evaluate the effect of packet sampling on the detection accuracy and then investigate why detection accuracy worsens when the packet sampling rate decreases. In addition, we show that, even with a low sampling rate, spatially partitioning the monitored traffic into groups makes it possible to increase the detection accuracy. We also develop a method of determining an appropriate number of partitioned groups and show its effectiveness.

UR - http://www.scopus.com/inward/record.url?scp=39349105464&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=39349105464&partnerID=8YFLogxK

U2 - 10.1109/GLOCOM.2007.376

DO - 10.1109/GLOCOM.2007.376

M3 - Conference contribution

AN - SCOPUS:39349105464

SN - 1424410436

SN - 9781424410439

SP - 1959

EP - 1964

BT - GLOBECOM - IEEE Global Telecommunications Conference

ER -