d

Anomaly Detection: The Complete Documentation

• This category contains 5 Papers
• The last paper was added on 2007-03-26 (YYYY-MM-DD)

Anomaly Detection in IP Networks

Published on 2003, by Marina Thottan and Chuanyi Ji, ©IEEE.

Network anomaly detection is a vibrant research area. Researchers have approached this problem using various techniques such as artificial intelligence, machine learning, and state machine modeling. In this paper, we first review these anomaly detection methods and then describe in detail a statistical signal processing technique based on abrupt change detection.We show that this signal processing technique is effective at detecting several network anomalies. Case studies from real network data that demonstrate the power of the signal processing approach to network anomaly detection are presented. The application of signal processing techniques to this area is still in its infancy, and we believe that it has great potential to enhance the field, and thereby improve the reliability of IP networks.

Characteristics of Network Traffic Flow Anomalies

Published on 2001, by Paul Barford and David Plonka, ©Paul Barford and David Plonka.

One of the primary tasks of network administrators is monitoring routers and switches for anomalous traffic behavior such as outages, configuration changes, flash crowds and abuse. Recognizing and identifying anomalous behavior is often based on ad hoc methods developed from years of experience in managing networks. A variety of commercial and open source tools have been developed to assist in this process, however these require policies and/or or thresholds to be defined by the user in order to trigger alerts. The better the description of the anomalous behavior, the more effective these tools become. In this extended abstract we describe a project focused on precise characterization of anomalous network traffic behavior.

Design and Implementation of an Anomaly Detection System: an Empirical Approach

Published on 2007, by Gaia Maselli, Luca Deri, Stefano Suin, ©Gaia Maselli, Luca Deri, Stefano Suin.

Network management platforms provide flexible facilities for setting up custom applications able to detect network anomalies on a specific environment. This is because each network is made of users, services and computers with a speciffic behaviour that is then reflected in the generated network traffic.

One of These Things is not Like the Others: The State of Anomaly Detection

Published on 2002-07-01, by Matthew Tanase , ©SecurityFocus.

"To some, our observations can be summarized succinctly as "bugs happen". That certainly is not news. But dismissing our results so cavalierly misses the point. Yes, bugs happen. But bugs can be fixed -if they are detected. The Internet is, as a whole, working remarkably well. Huge software packages (i.e., X11R5) can be distributed electronically. Connections span the globe. But the very success of the Internet makes some bugs invisible." - Steven Bellovin

Packet vs Flow-Based Anomaly Detection

Published on 2005, by Esphion Ltd., ©Esphion Ltd..

Operators of mission critical networks employ a variety of strategies to ensure uptime and availability. For network security, firewalls and intrusion prevention systems (IPSs) may be utilized, along with performance measurement tools and network infrastructure health monitoring systems.