Improving network anomaly detection via selective flow-based sampling

Androulidakis, G; Papavassiliou, S

dc.contributor.author	Androulidakis, G	en
dc.contributor.author	Papavassiliou, S	en
dc.date.accessioned	2014-03-01T01:28:40Z
dc.date.available	2014-03-01T01:28:40Z
dc.date.issued	2008	en
dc.identifier.issn	1751-8628	en
dc.identifier.uri	https://dspace.lib.ntua.gr/xmlui/handle/123456789/18906
dc.subject	Network Anomaly Detection	en
dc.subject.classification	Engineering, Electrical & Electronic	en
dc.subject.other	Internet	en
dc.subject.other	Numerical methods	en
dc.subject.other	Parameter estimation	en
dc.subject.other	Scalability	en
dc.subject.other	Telecommunication traffic	en
dc.subject.other	Anomaly detection effectiveness	en
dc.subject.other	Flow-based sampling	en
dc.subject.other	Malicious traffic	en
dc.subject.other	Security of data	en
dc.title	Improving network anomaly detection via selective flow-based sampling	en
heal.type	journalArticle	en
heal.identifier.primary	10.1049/iet-com:20070231	en
heal.identifier.secondary	http://dx.doi.org/10.1049/iet-com:20070231	en
heal.language	English	en
heal.publicationDate	2008	en
heal.abstract	Sampling has become an essential component of scalable Internet traffic monitoring and anomaly detection. A new flow-based sampling technique that focuses on the selection of small flows, which are usually the source of malicious traffic, is introduced and analysed. The proposed approach provides a flexible framework for preferential flow sampling that can effectively balance the tradeoff between the volume of the processed information and the anomaly detection accuracy. The performance evaluation of the impact of selective flow-based sampling on the anomaly detection process is achieved through the adoption and application of a sequential non-parametric change-point anomaly detection method on realistic data that have been collected from a real operational university campus network. The corresponding numerical results demonstrate that the proposed approach achieves to improve anomaly detection effectiveness and at the same time reduces the number of selected flows. © The Institution of Engineering and Technology 2008.	en
heal.publisher	INST ENGINEERING TECHNOLOGY-IET	en
heal.journalName	IET Communications	en
dc.identifier.doi	10.1049/iet-com:20070231	en
dc.identifier.isi	ISI:000255465500001	en
dc.identifier.volume	2	en
dc.identifier.issue	3	en
dc.identifier.spage	399	en
dc.identifier.epage	409	en