An Evaluation of the Effectiveness of Measurement-based Anomaly Detection Techniques Conference Paper

abstract

• A number of recent studies have proposed measurement based approaches to network traffic analysis. These techniques treat traffic volume and traffic header data as signals or images in order to make analysis feasible. We use trace-driven experiments and compare the performance of different strategies. Our evaluations on real traces reveal differences in the effectiveness of different traffic header data as potential signals for traffic analysis in terms of their detection rates and false alarm rates. Our results show that address distributions and number of flows are better signals than traffic volume for anomaly detection. 2006 IEEE.

name of conference

• 26th IEEE International Conference on Distributed Computing Systems Workshops (ICDCSW'06)

authors

• Reddy, Narasimha

published proceedings

• 26th IEEE International Conference on Distributed Computing Systems Workshops (ICDCSW'06)

author list (cited authors)

• Kim, S. S., & Reddy, A.

citation count

• 0

complete list of authors

• Kim, Seong Soo||Reddy, AL Narasimha

publication date

• January 2006

publisher

• Institute of Electrical and Electronics Engineers (IEEE)  Publisher

Digital Object Identifier (DOI)

• 10.1109/icdcsw.2006.16

International Standard Book Number (ISBN) 10

• 0769525415

International Standard Book Number (ISBN) 13

• 9780769525419

start page

• 1

end page

• 6

URL

• http://ieeexplore.ieee.org/xpl/mostRecentIssue.jsp?punumber=10968