A methodological overview on anomaly detection

Authors:
Christian Callegari;Angelo Coluccia;Alessandro D'Alconzo;Wendy Ellens;Stefano Giordano;Michel Mandjes;Michele Pagano;Teresa Pepe;Fabio Ricciato;Piotr Żuraniewski
Affiliations:
University of Pisa, Pisa, Italy;University of Salento, Lecce, Italy;Forschungszentrum Telekommunikation Wien, Vienna, Austria;TNO, Delft, The Netherlands;University of Pisa, Pisa, Italy;Korteweg-de Vries Institute for Mathematics, University of Amsterdam, The Netherlands, Eurandom, Eindhoven University of Technology, Eindhoven, The Netherlands, CWI, Amsterdam, The Netherlands;University of Pisa, Pisa, Italy;University of Pisa, Pisa, Italy;University of Salento, Lecce, Italy and Forschungszentrum Telekommunikation Wien, Vienna, Austria;TNO, Delft, The Netherlands and Korteweg-de Vries Institute for Mathematics, University of Amsterdam, The Netherlands and AGH University of Science and Technology, Krakow, Poland
Venue:
DataTraffic Monitoring and Analysis
Year:
2013

Citing 51
Cited 0

An Intrusion-Detection Model

IEEE Transactions on Software Engineering - Special issue on computer security and privacy
A Theory for Multiresolution Signal Decomposition: The Wavelet Representation

IEEE Transactions on Pattern Analysis and Machine Intelligence
Ten lectures on wavelets

Ten lectures on wavelets
On the self-similar nature of Ethernet traffic (extended version)

IEEE/ACM Transactions on Networking (TON)
Wavelets and subband coding

Wavelets and subband coding
LOF: identifying density-based local outliers

SIGMOD '00 Proceedings of the 2000 ACM SIGMOD international conference on Management of data
Efficient algorithms for mining outliers from large data sets

SIGMOD '00 Proceedings of the 2000 ACM SIGMOD international conference on Management of data
Real-time estimation of the parameters of long-range dependence

IEEE/ACM Transactions on Networking (TON)
A non-instrusive, wavelet-based approach to detecting network performance problems

IMW '01 Proceedings of the 1st ACM SIGCOMM Workshop on Internet Measurement
Measuring system normality

ACM Transactions on Computer Systems (TOCS)
A signal analysis of network traffic anomalies

Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurment
Data streams: algorithms and applications

SODA '03 Proceedings of the fourteenth annual ACM-SIAM symposium on Discrete algorithms
Finding Frequent Items in Data Streams

ICALP '02 Proceedings of the 29th International Colloquium on Automata, Languages and Programming
A simple algorithm for finding frequent elements in streams and bags

ACM Transactions on Database Systems (TODS)
What's hot and what's not: tracking most frequent items dynamically

Proceedings of the twenty-second ACM SIGMOD-SIGACT-SIGART symposium on Principles of database systems
ADMIT: anomaly-based data mining for intrusions

Proceedings of the eighth ACM SIGKDD international conference on Knowledge discovery and data mining
New directions in traffic measurement and accounting: Focusing on the elephants, ignoring the mice

ACM Transactions on Computer Systems (TOCS)
Sketch-based change detection: methods, evaluation, and applications

Proceedings of the 3rd ACM SIGCOMM conference on Internet measurement
Tabulation based 4-universal hashing with applications to second moment estimation

SODA '04 Proceedings of the fifteenth annual ACM-SIAM symposium on Discrete algorithms
Structural analysis of network traffic flows

Proceedings of the joint international conference on Measurement and modeling of computer systems
Diagnosing network-wide traffic anomalies

Proceedings of the 2004 conference on Applications, technologies, architectures, and protocols for computer communications
Characterization of network-wide anomalies in traffic flows

Proceedings of the 4th ACM SIGCOMM conference on Internet measurement
Reversible sketches for efficient and accurate change detection over network data streams

Proceedings of the 4th ACM SIGCOMM conference on Internet measurement
A Survey of Outlier Detection Methodologies

Artificial Intelligence Review
An improved data stream summary: the count-min sketch and its applications

Journal of Algorithms
Mining anomalies using traffic feature distributions

Proceedings of the 2005 conference on Applications, technologies, architectures, and protocols for computer communications
Identifying Intrusions in Computer Networks with Principal Component Analysis

ARES '06 Proceedings of the First International Conference on Availability, Reliability and Security
Sensitivity of PCA for traffic anomaly detection

Proceedings of the 2007 ACM SIGMETRICS international conference on Measurement and modeling of computer systems
k-means++: the advantages of careful seeding

SODA '07 Proceedings of the eighteenth annual ACM-SIAM symposium on Discrete algorithms
Approximate frequency counts over data streams

VLDB '02 Proceedings of the 28th international conference on Very Large Data Bases
Finding hierarchical heavy hitters in data streams

VLDB '03 Proceedings of the 29th international conference on Very large data bases - Volume 29
Extracting hidden anomalies using sketch and non Gaussian multiresolution statistical detection procedures

Proceedings of the 2007 workshop on Large scale attack defense
On attack causality in internet-connected cellular networks

SS'07 Proceedings of 16th USENIX Security Symposium on USENIX Security Symposium
Security for Telecommunications Networks

Security for Telecommunications Networks
Application of Wavelet Packet Transform to Network Anomaly Detection

NEW2AN '08 / ruSMART '08 Proceedings of the 8th international conference, NEW2AN and 1st Russian Conference on Smart Spaces, ruSMART on Next Generation Teletraffic and Wired/Wireless Advanced Networking
Network anomaly detection based on wavelet analysis

EURASIP Journal on Advances in Signal Processing - Special issue on signal processing applications in network intrusion detection systems
Anomaly detection: A survey

ACM Computing Surveys (CSUR)
Optimizing Fuzzy K-means for network anomaly detection using PSO

AICCSA '08 Proceedings of the 2008 IEEE/ACS International Conference on Computer Systems and Applications
On dominant characteristics of residential broadband internet traffic

Proceedings of the 9th ACM SIGCOMM conference on Internet measurement conference
Review: A review of DoS attack models for 3G cellular networks from a system-design perspective

Computer Communications
Analysis of the 1999 DARPA/Lincoln laboratory IDS evaluation data with NetADHICT

CISDA'09 Proceedings of the Second IEEE international conference on Computational intelligence for security and defense applications
On the role of flows and sessions in internet traffic modeling: an explorative toy-model

GLOBECOM'09 Proceedings of the 28th IEEE conference on Global telecommunications
On the use of sketches and wavelet analysis for network anomaly detection

Proceedings of the 6th International Wireless Communications and Mobile Computing Conference
Sketch-Based Streaming PCA Algorithm for Network-Wide Traffic Anomaly Detection

ICDCS '10 Proceedings of the 2010 IEEE 30th International Conference on Distributed Computing Systems
Distribution-based anomaly detection in 3G mobile networks: from theory to practice

International Journal of Network Management
Combining sketch and wavelet models for anomaly detection

ICCP '10 Proceedings of the Proceedings of the 2010 IEEE 6th International Conference on Intelligent Computer Communication and Processing
M/G/∞ transience, and its applications to overload detection

Performance Evaluation
Anomaly detection in IP networks

IEEE Transactions on Signal Processing
Detecting anomalies in backbone network traffic: a performance comparison among several change detection methods

International Journal of Sensor Networks
Entropy-based algorithms for best basis selection

IEEE Transactions on Information Theory - Part 2
Anomaly detection in VoIP traffic with trends

Proceedings of the 24th International Teletraffic Congress

Quantified Score

Hi-index	0.00

Visualization

Abstract

In this Chapter we give an overview of statistical methods for anomaly detection (AD), thereby targeting an audience of practitioners with general knowledge of statistics. We focus on the applicability of the methods by stating and comparing the conditions in which they can be applied and by discussing the parameters that need to be set.