Show simple item record

dc.contributor.authorLakhina, Anukoolen_US
dc.contributor.authorCrovella, Marken_US
dc.contributor.authorDiot, Christopheen_US
dc.date.accessioned2011-10-20T04:19:17Z
dc.date.available2011-10-20T04:19:17Z
dc.date.issued2004-05-19
dc.identifier.urihttps://hdl.handle.net/2144/1546
dc.description.abstractDetecting and understanding anomalies in IP networks is an open and ill-defined problem. Toward this end, we have recently proposed the subspace method for anomaly diagnosis. In this paper we present the first large-scale exploration of the power of the subspace method when applied to flow traffic. An important aspect of this approach is that it fuses information from flow measurements taken throughout a network. We apply the subspace method to three different types of sampled flow traffic in a large academic network: multivariate timeseries of byte counts, packet counts, and IP-flow counts. We show that each traffic type brings into focus a different set of anomalies via the subspace method. We illustrate and classify the set of anomalies detected. We find that almost all of the anomalies detected represent events of interest to network operators. Furthermore, the anomalies span a remarkably wide spectrum of event types, including denial of service attacks (single-source and distributed), flash crowds, port scanning, downstream traffic engineering, high-rate flows, worm propagation, and network outage.en_US
dc.description.sponsorshipCentre National de la Recherche Scientifique (CNRS) France; Sprint Labs; National Science Foundation (ANI-9986397, CCR-0325701)en_US
dc.language.isoen_US
dc.publisherBoston University Computer Science Departmenten_US
dc.relation.ispartofseriesBUCS Technical Reports;BUCS-TR-2004-020
dc.titleCharacterization of Network-Wide Anomalies in Traffic Flowsen_US
dc.typeTechnical Reporten_US


This item appears in the following Collection(s)

Show simple item record