Correlation among piecewise unwanted traffic time series

Kensuke Fukuda*, Toshio Hirotsu, Osamu Akashi, Toshiharu Sugawara


研究成果: Conference contribution

13 被引用数 (Scopus)


In this paper, we investigate temporal and spatial correlations of time series of unwanted traffic (i.e., darknet or network telescope traffic) in order to estimate statistical behavior of unwanted activities from a small size of darknet address block. First, from the analysis of long-range dependency, we point out that TCP time series has a weak temporal correlation though UDP time series without huge flooding is well-modeled using a Poisson process. Next, we analyze the spatial correlation between two traffic time series divided by different sized darknet address blocks. We confirm that a TCP SYN traffic time series (e.g, virus or worm) has a clear spatial correlation in the arrival of packets between two neighboring address blocks. Indeed, this spatial correlation remains in traffic time series 1,000 addresses far from the target time series, even if a darknet address block is small (e.g., /26). On the other hand, TCP SYNACK traffic (e.g., backscatter) and UDP traffic (e.g., virus or worm) have less spatial correlation between two adjacent large address blocks. Finally, we estimate the average propagation delay of global unwanted activities appearing in TCP SYN traffic by using the generalized inter-correlation coefficient.

ホスト出版物のタイトル2008 IEEE Global Telecommunications Conference, GLOBECOM 2008
出版ステータスPublished - 2008 12月 1
イベント2008 IEEE Global Telecommunications Conference, GLOBECOM 2008 - New Orleans, LA, United States
継続期間: 2008 11月 302008 12月 4


名前GLOBECOM - IEEE Global Telecommunications Conference


Conference2008 IEEE Global Telecommunications Conference, GLOBECOM 2008
国/地域United States
CityNew Orleans, LA

ASJC Scopus subject areas

  • 電子工学および電気工学


「Correlation among piecewise unwanted traffic time series」の研究トピックを掘り下げます。これらがまとまってユニークなフィンガープリントを構成します。