Sketch based Anomaly Detection, Identification and Performance Evaluation - ENS de Lyon - École normale supérieure de Lyon Accéder directement au contenu
Communication Dans Un Congrès Année : 2007

Sketch based Anomaly Detection, Identification and Performance Evaluation

Patrice Abry
Pierre Borgnat
Guillaume Dewaele
  • Fonction : Auteur
  • PersonId : 842999

Résumé

An anomaly detection procedure is defined and its statistical performance are carefully quantified. It is based on a non Gaussian modeling of the marginal distributions of random projections (sketches) of traffic aggregated jointly at different levels (multiresolution). To evaluate false negative vs. false positive in a controlled, reproducible and documented framework, we apply the detection procedure to traffic time-series from our self-made anomaly database. It is obtained by performing DDoS-type attacks, using real-world attack tools, over a real operational network. Also, we illustrate that combining sketches enables us to identify the target IP destination address and faulty packets hence opening the track to attack mitigation.
Fichier principal
Vignette du fichier
saint07_abry_SketchAnomalyDetect.pdf (206.12 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

ensl-00175474 , version 1 (28-09-2007)

Identifiants

  • HAL Id : ensl-00175474 , version 1

Citer

Patrice Abry, Pierre Borgnat, Guillaume Dewaele. Sketch based Anomaly Detection, Identification and Performance Evaluation. SAINT 2007 International Symposium on Applications and the Internet, Workshop on Internet Measurement Technology and its Applications to Building Next Generation Internet, IEEE-CS and IPSJ, Jan 2007, Hiroshima, Japan. ⟨ensl-00175474⟩
109 Consultations
95 Téléchargements

Partager

Gmail Facebook X LinkedIn More