Correlation among piecewise unwanted traffic time series

Kensuke Fukuda, Toshio Hirotsu, Osamu Akashi, Toshiharu Sugawara

    研究成果: Conference contribution

    13 引用 (Scopus)


    In this paper, we investigate temporal and spatial correlations of time series of unwanted traffic (i.e., darknet or network telescope traffic) in order to estimate statistical behavior of unwanted activities from a small size of darknet address block. First, from the analysis of long-range dependency, we point out that TCP time series has a weak temporal correlation though UDP time series without huge flooding is well-modeled using a Poisson process. Next, we analyze the spatial correlation between two traffic time series divided by different sized darknet address blocks. We confirm that a TCP SYN traffic time series (e.g, virus or worm) has a clear spatial correlation in the arrival of packets between two neighboring address blocks. Indeed, this spatial correlation remains in traffic time series 1,000 addresses far from the target time series, even if a darknet address block is small (e.g., /26). On the other hand, TCP SYNACK traffic (e.g., backscatter) and UDP traffic (e.g., virus or worm) have less spatial correlation between two adjacent large address blocks. Finally, we estimate the average propagation delay of global unwanted activities appearing in TCP SYN traffic by using the generalized inter-correlation coefficient.

    ホスト出版物のタイトルGLOBECOM - IEEE Global Telecommunications Conference
    出版物ステータスPublished - 2008
    イベント2008 IEEE Global Telecommunications Conference, GLOBECOM 2008 - New Orleans, LA
    継続期間: 2008 11 302008 12 4


    Other2008 IEEE Global Telecommunications Conference, GLOBECOM 2008
    New Orleans, LA


    ASJC Scopus subject areas

    • Electrical and Electronic Engineering


    Fukuda, K., Hirotsu, T., Akashi, O., & Sugawara, T. (2008). Correlation among piecewise unwanted traffic time series. : GLOBECOM - IEEE Global Telecommunications Conference (pp. 1616-1620). [4698089]