Detection accuracy of network anomalies using sampled flow statistics

Ryoichi Kawahara, Keisuke Ishibashi, Tatsuya Mori, Noriaki Kamiyama, Shigeaki Harada, Shoichiro Asano

Research output: Chapter in Book/Report/Conference proceedingConference contribution

7 Citations (Scopus)

Abstract

We investigate the detection accuracy of network anomalies when we use flow statistics obtained through packet sampling. We have already shown, through a case study based on measurement data, that network anomalies generating a huge number of small flows, such as network scans or SYN flooding, become hard to detect when we perform packet sampling. In this paper, we first develop an analytical model that enables us to quantitatively evaluate the effect of packet sampling on the detection accuracy and then investigate why detection accuracy worsens when the packet sampling rate decreases. In addition, we show that, even with a low sampling rate, spatially partitioning the monitored traffic into groups makes it possible to increase the detection accuracy. We also develop a method of determining an appropriate number of partitioned groups and show its effectiveness.

Original languageEnglish
Title of host publicationIEEE GLOBECOM 2007 - 2007 IEEE Global Telecommunications Conference, Proceedings
Pages1959-1964
Number of pages6
DOIs
Publication statusPublished - 2007 Dec 1
Externally publishedYes
Event50th Annual IEEE Global Telecommunications Conference, GLOBECOM 2007 - Washington, DC, United States
Duration: 2007 Nov 262007 Nov 30

Publication series

NameGLOBECOM - IEEE Global Telecommunications Conference

Conference

Conference50th Annual IEEE Global Telecommunications Conference, GLOBECOM 2007
CountryUnited States
CityWashington, DC
Period07/11/2607/11/30

ASJC Scopus subject areas

  • Engineering(all)

Fingerprint Dive into the research topics of 'Detection accuracy of network anomalies using sampled flow statistics'. Together they form a unique fingerprint.

  • Cite this

    Kawahara, R., Ishibashi, K., Mori, T., Kamiyama, N., Harada, S., & Asano, S. (2007). Detection accuracy of network anomalies using sampled flow statistics. In IEEE GLOBECOM 2007 - 2007 IEEE Global Telecommunications Conference, Proceedings (pp. 1959-1964). [4411286] (GLOBECOM - IEEE Global Telecommunications Conference). https://doi.org/10.1109/GLOCOM.2007.376