Detection accuracy of network anomalies using sampled flow statistics

Ryoichi Kawahara, Keisuke Ishibashi, Tatsuya Mori, Noriaki Kamiyama, Shigeaki Harada, Haruhisa Hasegawa, Shoichiro Asano

Research output: Contribution to journalArticle

5 Citations (Scopus)

Abstract

We investigated the detection accuracy of network anomalies when using flow statistics obtained through packet sampling. Through a case study based on measurement data, we showed that network anomalies generating a large number of small flows, such as network scans or SYN flooding, become difficult to detect during packet sampling. We then developed an analytical model that enables us to quantitatively evaluate the effect of packet sampling and traffic conditions, such as anomalous traffic volume, on detection accuracy. We also investigated how the detection accuracy worsens when the packet sampling rate decreases. In addition, we show that, even with a low sampling rate, spatially partitioning monitored traffic into groups makes it possible to increase detection accuracy. We also developed a method of determining an appropriate number of partitioned groups, and we show its effectiveness.

Original languageEnglish
Pages (from-to)513-535
Number of pages23
JournalInternational Journal of Network Management
Volume21
Issue number6
DOIs
Publication statusPublished - 2011 Nov 1

    Fingerprint

ASJC Scopus subject areas

  • Computer Science Applications
  • Computer Networks and Communications

Cite this

Kawahara, R., Ishibashi, K., Mori, T., Kamiyama, N., Harada, S., Hasegawa, H., & Asano, S. (2011). Detection accuracy of network anomalies using sampled flow statistics. International Journal of Network Management, 21(6), 513-535. https://doi.org/10.1002/nem.777