NADA - network anomaly detection algorithm

Authors:
Sílvia Farraposo;Philippe Owezarski;Edmundo Monteiro
Affiliations:
School of Technology and Management of Leiria, Leiria, Apartado, Portugal;LAAS, CNRS, Toulouse Cedex 4, France;Laboratory of Communications and Telematics, Computer Science Department, Coimbra, Portugal
Venue:
DSOM'07 Proceedings of the Distributed systems: operations and management 18th IFIP/IEEE international conference on Managing virtualization of networks and services
Year:
2007

Citing 2
Cited 2

Mining anomalies using traffic feature distributions

Proceedings of the 2005 conference on Applications, technologies, architectures, and protocols for computer communications
What's new: finding significant differences in network data streams

IEEE/ACM Transactions on Networking (TON)

An image processing approach to traffic anomaly detection

Proceedings of the 4th Asian Conference on Internet Engineering
A database of anomalous traffic for assessing profile based IDS

TMA'10 Proceedings of the Second international conference on Traffic Monitoring and Analysis

Quantified Score

Hi-index	0.00

Visualization

Abstract

This paper deals with a new iterative Network Anomaly Detection Algorithm - NADA, which accomplishes the detection, classification and identification of traffic anomalies. NADA fully provides all information required limiting the extent of anomalies by locating them in time, by classifying them, and identifying their features as, for instance, the source and destination addresses and ports involved. To reach its goal, NADA uses a generic multi-featured algorithm executed at different time scales and at different levels of IP aggregation. Besides that, the NADA approach contributes to the definition of a set of traffic anomaly behavior-based signatures. The use of these signatures makes NADA suitable and efficient to use in a monitoring environment.