1,721,149 research outputs found
Application of Wavelet Packet Transform to Network Anomaly Detection
No full textIn the last few years, the number and impact of security attacks over the Internet have been continuously increasing. Since it seems impossible to guarantee complete protection to a system by means of the "classical" prevention mechanisms, the use of Intrusion Detection systems (IDSs) has emerged as a key element in network security. In this paper we address the problem considering different, methods, based on the Wavelet Packet Transform, for detecting anomalies in the network traffic, taking into account both the best basis and the value of transformed coefficients
Data traffic monitoring and analysis from measurement, classification, and anomaly detection to quality of experience
No full textA Probabilistic Counting Framework for Distributed Measurements
Get PDFThe technological maturity attained by general purpose processors and network interface cards makes today's commodity PCs viable and high performing alternatives to specialized hardware for deploying network devices, such as switches, routers, and generic middleboxes. In addition, the flexibility of the software solution seems to be perfectly in line with the emerging trend towards the data-plane programming abstractions brought by recent proposals such as Openflow and the P4 language. However, if programming abstractions provide the way elementary instructions (primitives) are combined together, the development of such processing primitives is left to the network programmer. Although the type of such functions is strongly domain specific, we can safely assume that the counting primitive is easily required in a great deal of practical contexts. This paper presents a counting framework based on probabilistic sketches and LogLog counters for estimating the cardinality of large multi-sets of data. The proposed data structure is designed to be fast and compact for ready use in the on-line chain of processing of network devices running at multi-gigabit speeds. The complete implementation is provided within the probabilistic data structures (pds) library which has been designed, developed, experimentally assessed, and released as open-source for free download. Although the paper specifically presents two possible use-cases, the pds library can be used in rather general scenarios, even outside the networking domain
Optimal Design of Service Overlay Networks with economic and performance constraints
No full textIn the last years, Service Overlay Networks (SONs) have emerged as a promising means to address some of the issues (e.g. end-to-end QoS) affecting the current Internet and to favor the development and deployment of new value-added Internet services. The deployment of an SON is a capital-intensive
investment, since bandwidth with certain QoS guarantees must be purchased from the individual network domains through bilateral Service Level Agreements. Thus, minimizing the economic cost of the logical end-to-end service delivery infrastructure is one of the key objectives for the SON provider. When a SON is aimed at end-to-end QoS provisioning, its topology must be designed so as to also satisfy the specific requirements of QoS-sensitive applications. This paper deals with the problem of planning the SON topology in order to take into account both cost and QoS constraints. More specifically, the paper
proposes a set of new algorithms for the design of an optimized SON topology, which minimizes the economic cost while simultaneously meeting bandwidth and delay constraints. A performance comparison among such algorithms is finally carried out
A survey of congestion control mechanisms in linux TCP (extended abstract)
No full textThe Transmission Control Protocol (TCP) is used by the vast majority of Internet applications. Since its introduction in the 1970s, a lot of variants have been proposed to cope with the different network conditions we can have (e.g., wired networks, wireless networks, satellite links) and nowadays Linux OS includes 13 different TCP variants. The aim of this paper is to provide a complete survey of the different congestion control mechanisms used by the variants of the TCP implemented in the Linux Kernel 2.6.x
WAVE-CUSUM: Improving CUSUM performance in network anomaly detection by means of wavelet analysis
No full textThe increasing number of network attacks causes growing problems for network operators and users. Thus, detecting anomalous traffic is of primary interest in IP networks management and many detection techniques, able to promptly reveal and identify
network attacks, mainly detecting Heavy Changes in the network traffic, have been
proposed. Among these, one of the most promising approach is based on the use of the
CUSUM (CUmulative SUM). Nonetheless, CUSUM performance is strongly affected by its
sensitivity to the presence of seasonal trends in the considered data.
For this reason, in this paper we propose a novel detection method based on the idea of performing a pre-processing stage of the data by means of wavelets, aimed at filtering out such trends, before applying the CUSUM algorithm.
The performance analysis, presented in the paper, demonstrates the efficiency of the proposed method, focusing on the performance improvements due to the pre-processing stage
- …
