Using selective sampling for the support of scalable and efficient network anomaly detection

Androulidakis, G; Chatzigiannakis, V; Papavassiliou, S

dc.contributor.author	Androulidakis, G	en
dc.contributor.author	Chatzigiannakis, V	en
dc.contributor.author	Papavassiliou, S	en
dc.date.accessioned	2014-03-01T02:45:00Z
dc.date.available	2014-03-01T02:45:00Z
dc.date.issued	2007	en
dc.identifier.uri	https://dspace.lib.ntua.gr/xmlui/handle/123456789/32085
dc.subject	Anomaly detection	en
dc.subject	Principal component analysis	en
dc.subject	Selective sampling	en
dc.subject	Traffic measurements	en
dc.subject.other	Anomaly detection	en
dc.subject.other	Anomaly detections	en
dc.subject.other	Essential components	en
dc.subject.other	Internet traffic monitoring	en
dc.subject.other	Network Anomaly detection	en
dc.subject.other	Network attacks	en
dc.subject.other	Performance evaluation	en
dc.subject.other	Principal component analysis (PCA)	en
dc.subject.other	Realistic data	en
dc.subject.other	Selective sampling	en
dc.subject.other	Traffic measurements	en
dc.subject.other	University campus	en
dc.subject.other	Worm propagations	en
dc.subject.other	Classification (of information)	en
dc.subject.other	Computer crime	en
dc.subject.other	Financial data processing	en
dc.subject.other	Internet	en
dc.subject.other	Sampling	en
dc.subject.other	Principal component analysis	en
dc.title	Using selective sampling for the support of scalable and efficient network anomaly detection	en
heal.type	conferenceItem	en
heal.identifier.primary	10.1109/GLOCOMW.2007.4437785	en
heal.identifier.secondary	4437785	en
heal.identifier.secondary	http://dx.doi.org/10.1109/GLOCOMW.2007.4437785	en
heal.publicationDate	2007	en
heal.abstract	Sampling has become an essential component of scalable Internet traffic monitoring and anomaly detection. In this paper we consider the problem of studying and evaluating the impact of selective sampling on anomaly detection. Selective sampling focuses on the selection of small flows that are usually the source of many network attacks (DDoS, portscans, worm propagation). One of the key objectives of our study is to gain some insight about the feasibility and scalability of the anomaly detection process, by analyzing and understanding the tradeoff of reducing the volume of collected data while still maintaining the accuracy and effectiveness in the anomaly detection. The performance evaluation study is achieved through the adoption and application of an anomaly detection method based on Principal Component Analysis (PCA) using realistic data that have been collected from a real operational university campus network.	en
heal.journalName	GLOBECOM - IEEE Global Telecommunications Conference	en
dc.identifier.doi	10.1109/GLOCOMW.2007.4437785	en