On accurate and scalable anomaly detection in next generation mobile network

Authors:
Fazirulhisyam Hashim;Abbas Jamalipour
Affiliations:
The University of Sydney, NSW, Australia;The University of Sydney, NSW, Australia
Venue:
ICC'09 Proceedings of the 2009 IEEE international conference on Communications
Year:
2009

Citing 8
Cited 0

Wide area traffic: the failure of Poisson modeling

IEEE/ACM Transactions on Networking (TON)
Building a better NetFlow

Proceedings of the 2004 conference on Applications, technologies, architectures, and protocols for computer communications
Change-Point Monitoring for the Detection of DoS Attacks

IEEE Transactions on Dependable and Secure Computing
Estimating flow distributions from sampled flow statistics

IEEE/ACM Transactions on Networking (TON)
Inverting sampled traffic

IEEE/ACM Transactions on Networking (TON)
Impact of packet sampling on anomaly detection metrics

Proceedings of the 6th ACM SIGCOMM conference on Internet measurement
Impact of Packet Sampling on Portscan Detection

IEEE Journal on Selected Areas in Communications
On designing issues of the next generation mobile network

IEEE Network: The Magazine of Global Internetworking

Quantified Score

Hi-index	0.00

Visualization

Abstract

This paper proposes an adaptive sampling strategy to address the accuracy and scalability issues of anomaly detection at high-speed backbone side of Next Generation Mobile Network (NGMN). The proposed sampling strategy is formulated based on the network traffic condition. It is constituted by two important functions namely the traffic identification and the sampling decision. While the former utilizes spectral analysis to identify the severity status of the traffic flows, the latter exploits both the flow status and flow size to compute the optimal sampling rate. In addition, a renormalization process is proposed to address the scalability issue in the network. Our analysis demonstrates that the proposed technique is efficient in providing adequate statistics for detecting anomaly traffic and scales well to the high speed traffic of NGMN.