Traffic anomaly detection and characterization in the tunisian national university network

  • Authors:

  • Khadija Houerbi Ramah;Hichem Ayari;Farouk Kamoun

  • Affiliations:

  • Ecole d’Aviation Borj El Amri;CRISTAL laboratory, École Nationale des Sciences de l’Informatique, University of Manouba, Manouba, Tunisia;CRISTAL laboratory, École Nationale des Sciences de l’Informatique, University of Manouba, Manouba, Tunisia

  • Venue:
  • NETWORKING'06 Proceedings of the 5th international IFIP-TC6 conference on Networking Technologies, Services, and Protocols; Performance of Computer and Communication Networks; Mobile and Wireless Communications Systems
  • Year:
  • 2006

Quantified Score

Hi-index 0.00

Visualization

Abstract

Traffic anomalies are characterized by unusual and significant changes in a network traffic behavior. They can be malicious or unintentional. Malicious traffic anomalies can be caused by attacks, abusive network usage and worms or virus propagations. However unintentional ones can be caused by failures, flash crowds or router misconfigurations. In this paper, we present an anomaly detection system derived from the anomaly detection schema presented by Mei-Ling Shyu in [12] and based on periodic SNMP data collection. We have evaluated this system against some common attacks and found that some (Smurf, Sync flood) are better detected than others (Scan). Then we have made use of this system in order to detect traffic anomalies in the Tunisian National University Network (TNUN). For this, we have collected network traffic traces from the Management Information Base MIB of the central firewall of the TNUN network. After that, we calculated the inter-anomaly times distribution and the anomaly durations distribution. We showed that anomalies were prevalent in the TNUN network and that most anomalies lasted less than five minutes.