Volume traffic anomaly detection using hierarchical clustering

Authors:
Choonho Son;Seok-Hyung Cho;Jae-Hyoung Yoo
Affiliations:
Network R&D Laboratory, Daejeon, Korea;Network R&D Laboratory, Daejeon, Korea;Network R&D Laboratory, Daejeon, Korea
Venue:
APNOMS'09 Proceedings of the 12th Asia-Pacific network operations and management conference on Management enabling the future internet for changing business and new computing services
Year:
2009

Citing 11
Cited 1

A signal analysis of network traffic anomalies

Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurment
Diagnosing network-wide traffic anomalies

Proceedings of the 2004 conference on Applications, technologies, architectures, and protocols for computer communications
Internet Measurement

IEEE Internet Computing
Transport layer identification of P2P traffic

Proceedings of the 4th ACM SIGCOMM conference on Internet measurement
The impact of residential broadband traffic on Japanese ISP backbones

ACM SIGCOMM Computer Communication Review
Mining anomalies using traffic feature distributions

Proceedings of the 2005 conference on Applications, technologies, architectures, and protocols for computer communications
BLINC: multilevel traffic classification in the dark

Proceedings of the 2005 conference on Applications, technologies, architectures, and protocols for computer communications
Analysis of internet backbone traffic and header anomalies observed

Proceedings of the 7th ACM SIGCOMM conference on Internet measurement
Internet traffic classification demystified: myths, caveats, and the best practices

CoNEXT '08 Proceedings of the 2008 ACM CoNEXT Conference
Wide-area Internet traffic patterns and characteristics

IEEE Network: The Magazine of Global Internetworking
Packet-level traffic measurements from the Sprint IP backbone

IEEE Network: The Magazine of Global Internetworking

Active learning and subspace clustering for anomaly detection

Intelligent Data Analysis

Quantified Score

Hi-index	0.00

Visualization

Abstract

In a large backbone network, it is important to detect shape traffic fluctuation for servicing robust network. However, there are too many interfaces to monitor the characteristics of traffic. First we collect volume traffic of boundary link. From the volume traffic, we make groups which have similar traffic patterns by hierarchical clustering algorithm. This result shows that most of traffic has similar patterns, but some traffic which is far from centroid has an anomaly traffic pattern. This paper gives a hint for network operators that which traffic has to be checked out.