Intelligent flow-based sampling for effective network anomaly detection

Androulidakis, G; Papavassiliou, S

dc.contributor.author	Androulidakis, G	en
dc.contributor.author	Papavassiliou, S	en
dc.date.accessioned	2014-03-01T02:44:42Z
dc.date.available	2014-03-01T02:44:42Z
dc.date.issued	2007	en
dc.identifier.uri	https://dspace.lib.ntua.gr/xmlui/handle/123456789/31941
dc.subject	Anomaly detection	en
dc.subject	Sampling	en
dc.subject	Traffic measurements	en
dc.subject.other	Anomaly detection	en
dc.subject.other	Flow sampling	en
dc.subject.other	Network attacks	en
dc.subject.other	Traffic measurements	en
dc.subject.other	Computer worms	en
dc.subject.other	Intelligent agents	en
dc.subject.other	Scalability	en
dc.subject.other	Telecommunication traffic	en
dc.subject.other	Intrusion detection	en
dc.title	Intelligent flow-based sampling for effective network anomaly detection	en
heal.type	conferenceItem	en
heal.identifier.primary	10.1109/GLOCOM.2007.374	en
heal.identifier.secondary	http://dx.doi.org/10.1109/GLOCOM.2007.374	en
heal.identifier.secondary	4411284	en
heal.publicationDate	2007	en
heal.abstract	Sampling has become an essential component of scalable Internet traffic monitoring and anomaly detection. In this paper, the emphasis is placed on the evaluation of the impact of using intelligent flow sampling techniques on the anomaly detection process. Based on the observation that small flows are usually the source of many network attacks (DDoS, portscans, worm propagation) we first introduce a new flow sampling methodology that focuses on the selection of small flows and achieves to improve anomaly detection effectiveness, while at the same time reduces the number of selected flows. The performance evaluation of the impact of intelligent flow-based sampling on the anomaly detection process is achieved through the adoption and application of a sequential non-parametric Change-Point Detection anomaly detection method on realistic data that have been collected from a real operational university campus network. © 2007 IEEE.	en
heal.journalName	GLOBECOM - IEEE Global Telecommunications Conference	en
dc.identifier.doi	10.1109/GLOCOM.2007.374	en
dc.identifier.spage	1948	en
dc.identifier.epage	1953	en