DocumentCode :
2892931
Title :
Monitoring Abnormal Traffic Flows Based on Independent Component Analysis
Author :
Qin, Tao ; Guan, Xiaohong ; Li, Wei ; Wang, Pinghui
Author_Institution :
SKLMS Lab., Xian Jiaotong Univ., Xian, China
fYear :
2009
fDate :
14-18 June 2009
Firstpage :
1
Lastpage :
5
Abstract :
The randomness of the network behaviors poses serious challenges for discovering the abnormal patterns in network traffic flows. This paper presents a method based on blind source separation approach for detecting abnormal traffic flows. It decomposes the network traffic into two components: the routine pattern and the abnormal pattern. The scale-space filter with adaptive scale is applied to filter the noise without affecting the main behavior patterns which can be used to form the abnormal traffic metrics and profiles. The zero-crossing method is applied to extract the stochastic behavior pulse widths and the largest width is selected as the scale space factor. In this way, the influence of the inherent randomness could be removed or greatly reduced. The extracted patterns of the routine behaviors imply the user´s habit and the abnormal patterns are useful for discovering anomalous behaviors such as scanning, flooding and content distribution attacks. A salient feature of the method is that no supervised learning process is needed. This is a very important advantage since obtaining labeled samples in traffic monitoring is extremely difficult. Experimental results based on the datasets of an actual network show that this method is effective for monitoring anomaly traffic flows in the gigabytes traffic environment and the identification accuracy is above 95%.
Keywords :
blind source separation; independent component analysis; telecommunication traffic; abnormal behavior detection; blind source separation; independent component analysis; network traffic; scale space filter; traffic flows; traffic monitoring; Blind source separation; Filters; Independent component analysis; Large-scale systems; Microphones; Monitoring; Pattern analysis; Principal component analysis; Supervised learning; Telecommunication traffic;
fLanguage :
English
Publisher :
ieee
Conference_Titel :
Communications, 2009. ICC '09. IEEE International Conference on
Conference_Location :
Dresden
ISSN :
1938-1883
Print_ISBN :
978-1-4244-3435-0
Electronic_ISBN :
1938-1883
Type :
conf
DOI :
10.1109/ICC.2009.5199196
Filename :
5199196
Link To Document :
بازگشت